From owner-freebsd-stable  Sat Mar 23  5: 5:27 2002
Delivered-To: freebsd-stable@freebsd.org
Received: from witchspace.com (pc1-reda4-0-cust134.bre.cable.ntl.com [213.105.81.134])
	by hub.freebsd.org (Postfix) with SMTP id 4C80437B404
	for <freebsd-stable@freebsd.org>; Sat, 23 Mar 2002 05:05:11 -0800 (PST)
Received: (qmail 363 invoked from network); 23 Mar 2002 13:05:09 -0000
Received: from lexx.witchspace.com (HELO witchspace.com) (192.168.0.1)
  by dookie.witchspace.com with SMTP; 23 Mar 2002 13:05:09 -0000
Message-ID: <3C9C7D92.1000706@witchspace.com>
Date: Sat, 23 Mar 2002 13:05:22 +0000
From: Jonathan Belson <jon@witchspace.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.8) Gecko/20020312
X-Accept-Language: en-us
MIME-Version: 1.0
To: freebsd-stable@freebsd.org
Subject: Network slowdowns...
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

Hiya


I've recently been experiencing slowdowns on my server's outgoing
network port, which occur after half a day to a day after the last
reboot.

To briefly summarise:

I have an old K6-2 300 acting as a gateway and firewall between
my internal network and my DSL connection.  It was working fine
until a few days ago when I upgraded the harddrive to a 60GB
120GXP, upgraded to the latest -stable, and switched off the
DEFAULT_TO_ACCEPT firewall option.

Every thing is fine until the system starts to play up, at which
point traffic through the server->DSL box starts to become
really slow - when ssh-ing in from a remote machine, characters
can take several seconds to appear - all other services are
affected in the same way.  There don't seem to be any clues in
the log files, either.

Internal networking (fxp0) always works fine, and rebooting always
fixes the problem.


Here is the dmesg:

Copyright (c) 1992-2002 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD 4.5-STABLE #1: Thu Mar 21 12:13:11 GMT 2002
     jon@dookie.witchspace.com:/usr/obj/usr/src/sys/DOOKIE
Timecounter "i8254"  frequency 1193182 Hz
Timecounter "TSC"  frequency 298816447 Hz
CPU: AMD-K6(tm) 3D processor (298.82-MHz 586-class CPU)
   Origin = "AuthenticAMD"  Id = 0x580  Stepping = 0
   Features=0x8001bf<FPU,VME,DE,PSE,TSC,MSR,MCE,CX8,MMX>
   AMD Features=0x80000800<SYSCALL,3DNow!>
real memory  = 67108864 (65536K bytes)
avail memory = 62230528 (60772K bytes)
Preloaded elf kernel "kernel" at 0xc0315000.
md0: Malloc disk
Using $PIR table, 5 entries at 0xc00fdae0
npx0: <math processor> on motherboard
npx0: INT 16 interface
pcib0: <VIA 82C598MVP (Apollo MVP3) host bridge> on motherboard
pci0: <PCI bus> on pcib0
pcib1: <VIA 82C598MVP (Apollo MVP3) PCI-PCI (AGP) bridge> at device 1.0 
on pci0
pci1: <PCI bus> on pcib1
pci1: <3Dfx Voodoo 3 graphics accelerator> at 0.0 irq 11
isab0: <VIA 82C586 PCI-ISA bridge> at device 7.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <VIA 82C586 ATA33 controller> port 0xc000-0xc00f at device 7.1 
on pci0
ata0: at 0x1f0 irq 14 on atapci0
ata1: at 0x170 irq 15 on atapci0
chip1: <VIA 82C586B ACPI interface> at device 7.3 on pci0
fxp0: <Intel Pro 10/100B/100+ Ethernet> port 0xc400-0xc41f mem 
0xed000000-0xed0fffff,0xed120000-0xed120fff irq 10 at device 9.0 on pci0
fxp0: Ethernet address 00:a0:c9:4b:f8:33
inphy0: <i82555 10/100 media interface> on miibus0
inphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
xl0: <3Com 3c905-TX Fast Etherlink XL> port 0xc800-0xc83f irq 9 at 
device 10.0 on pci0
xl0: Ethernet address: 00:60:08:4f:f6:f8
miibus1: <MII bus> on xl0
nsphy0: <DP83840 10/100 media interface> on miibus1
nsphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
atapci1: <Promise ATA66 controller> port 
0xdc00-0xdc3f,0xd800-0xd803,0xd400-0xd407,0xd000-0xd003,0xcc00-0xcc07 
mem 0xed100000-0xed11ffff irq 12 at device 11.0 on pci0
ata2: at 0xcc00 on atapci1
ata3: at 0xd400 on atapci1
orm0: <Option ROMs> at iomem 0xc0000-0xc7fff,0xc8000-0xc97ff on isa0
fdc0: <NEC 72065B or clone> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on isa0
fdc0: FIFO enabled, 8 bytes threshold
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
atkbd0: <AT Keyboard> flags 0x1 irq 1 on atkbdc0
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
IP packet filtering initialized, divert enabled, rule-based forwarding 
enabled, default to deny, logging limited to 10 packets/entry by default
IP Filter: v3.4.20 initialized.  Default = pass all, Logging = disabled
ad4: 58644MB <IC35L060AVVA07-0> [119150/16/63] at ata2-master UDMA66
acd0: MODE_SENSE_BIG command timeout - resetting
ata1: resetting devices .. done
acd0: MODE_SENSE_BIG DONEDRQ
acd0: MODE_SENSE_BIG - ABORTED COMMAND asc=0x4e ascq=0x00 error=0x00
acd0: MODE_SENSE_BIG command timeout - resetting
ata1: resetting devices .. done
acd0: MODE_SENSE_BIG DONEDRQ
acd0: MODE_SENSE_BIG - ABORTED COMMAND asc=0x4e ascq=0x00 error=0x00
acd0: MODE_SENSE_BIG command timeout - resetting
ata1: resetting devices .. done
acd0: MODE_SENSE_BIG DONEDRQ
acd0: MODE_SENSE_BIG - ABORTED COMMAND asc=0x4e ascq=0x00 error=0x00
acd0: MODE_SENSE_BIG command timeout - resetting
ata1: resetting devices .. done
acd0: MODE_SENSE_BIG DONEDRQ
acd0: MODE_SENSE_BIG - ABORTED COMMAND asc=0x4e ascq=0x00 error=0x00
acd0: MODE_SENSE_BIG command timeout - resetting
ata1: resetting devices .. done
acd0: MODE_SENSE_BIG DONEDRQ
acd0: MODE_SENSE_BIG - ABORTED COMMAND asc=0x4e ascq=0x00 error=0x00
acd0: CDROM <MATSHITA CR-581> at ata1-master PIO3
Mounting root from ufs:/dev/ad4s1a


I've always had the "MODE_SENSE_BIG - ABORTED COMMAND" bits; the
harddrive is on a PCI ATA66 card.

Here are the relevent bits of my firewall script (IPs changed to
protect the guilty 8^)


[Ss][Ii][Mm][Pp][Ll][Ee])
	############
	# This is a prototype setup for a simple firewall.  Configure this
	# machine as a named server and ntp server, and point all the machines
	# on the inside at this machine for those services.
	############

	# set these to your outside interface network and netmask and ip
	oif="xl0"
	onet="213.105.71.0"
	#onet="192.0.2.0"
	omask="255.255.255.0"
	oip="213.105.71.121"
	#oip="192.0.2.1"

	# set these to your inside interface network and netmask and ip
	iif="fxp0"
	inet="192.168.0.0"
	imask="255.255.255.0"
	iip="192.168.0.100"

	# Stop spoofing
	${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
	${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}

	# Stop RFC1918 nets on the outside interface
	${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
	${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
	${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}

	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
	# on the outside interface
	${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
	${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
	${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
	${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
	${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}

	# Network Address Translation.  This rule is placed here deliberately
	# so that it does not interfere with the surrounding address-checking
	# rules.  If for example one of your internal LAN machines had its IP
	# address set to 192.0.2.1 then an incoming packet for it after being
	# translated by natd(8) would match the `deny' rule above.  Similarly
	# an outgoing packet originated from it before being translated would
	# match the `deny' rule below.
	case ${natd_enable} in
	[Yy][Ee][Ss])
		if [ -n "${natd_interface}" ]; then
			${fwcmd} add divert natd all from any to any via ${natd_interface}
		fi
		;;
	esac

	# Stop RFC1918 nets on the outside interface
	${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
	${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
	${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}

	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
	# on the outside interface
	${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
	${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
	${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
	${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
	${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}

	# Allow TCP through if setup succeeded
	${fwcmd} add pass tcp from any to any established

	# Allow IP fragments to pass through
	${fwcmd} add pass all from any to any frag

	# Allow setup of incoming email
	#${fwcmd} add pass tcp from any to ${oip} 25 setup

	# ssh
	${fwcmd} add pass tcp from any to ${oip} 22 setup
	${fwcmd} add pass udp from any to ${oip} 22
	${fwcmd} add pass udp from ${oip} 22 to any

	# Deny access to our DNS
	#${fwcmd} add deny tcp from any to ${oip} 53 setup
	#${fwcmd} add deny udp from any to ${oip} 53
	#${fwcmd} add deny udp from ${oip} 53 to any

	${fwcmd} add allow tcp from 192.168.0.0/24 to any 53 setup
	${fwcmd} add allow udp from 192.168.0.0/24 to any 53
	${fwcmd} add allow udp from 192.168.0.0/24 53 to any

	# Enable NFS
	#${fwcmd} add allow tcp from 192.168.0.0/24 to any 2049 setup
	#${fwcmd} add allow udp from 192.168.0.0/24 to any 2049
	#${fwcmd} add allow udp from 192.168.0.0/24 2049 to any

	# Allow access to our WWW
	#${fwcmd} add pass tcp from any to ${oip} 80 setup

	# Reject&Log all setup of incoming connections from the outside
	${fwcmd} add deny log tcp from any to any in via ${oif} setup

	# Allow setup of any other TCP connection
	${fwcmd} add pass tcp from any to any setup

	# Allow DNS queries out in the world
	${fwcmd} add pass udp from ${oip} to any 53 keep-state

	# Allow NTP queries out in the world
	${fwcmd} add pass udp from ${oip} to any 123 keep-state

	# NetBIOS stuff
	${fwcmd} add deny all from ${oip} to any 137
	${fwcmd} add deny all from ${oip} to any 138
	${fwcmd} add deny all from ${oip} to any 139
	#${fwcmd} add deny tcp from ${oip} to any 137
	#${fwcmd} add deny tcp from ${oip} to any 138
	#${fwcmd} add deny tcp from ${oip} to any 139


	# Everything else is denied by default, unless the
	# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
	# config file.
	;;


Has anyone experienced anything similar?  In the meantime I'll try going 
back to my old harddrive and seeing if i can reproduce the problem.

Cheers,


--Jon

<http://www.witchspace.com>



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message