Друзья, помогите пожалуйста разобраться с проблемой скорости
Nodeny 50.32
Ядро и BRAS на разных серверах.
BRAS сервер HP Proliant G8 360, 2CPU 2,6 Ghz - сетевая Intel 82576
Вход и выход собраны в lagg - итого два гига вход и выход
Абоненты терминируются через PPPoE на mpd. Nat на pf, детализация на ipcad
Проблема: при включенном ipfw и именно правилах pipe со скоростью какая то дичь, исхода нет, вход 10-13 мегабит
Как только выключаешь ipfw - все летает, больше гигабита пролетает без проблем. При этом очевидных проблем с перегрузом ядер нет - все равномерно.
FreeBSD bras7 11.2-STABLE FreeBSD 11.2-STABLE #0: Sun Dec 23 20:44:08 EET 2018 root@bras7:/usr/obj/usr/src/sys/BRAS7 amd64
В ядро Generic добавил опции:
# NAS KERNEL OPTIONS
options IPFIREWALL
options IPFIREWALL_NAT
options LIBALIAS
options IPDIVERT
options DUMMYNET
options IPFIREWALL_DEFAULT_TO_ACCEPT
options PANIC_REBOOT_WAIT_TIME=3
options NETGRAPH
options NETGRAPH_BPF
options NETGRAPH_IPFW
options NETGRAPH_ETHER
options NETGRAPH_IFACE
options NETGRAPH_PPP
options NETGRAPH_PPTPGRE
options NETGRAPH_PPPOE
options NETGRAPH_SOCKET
options NETGRAPH_KSOCKET
options NETGRAPH_ONE2MANY
options NETGRAPH_SPLIT
options NETGRAPH_TEE
options NETGRAPH_TCPMSS
options NETGRAPH_VJC
options NETGRAPH_RFC1490
options NETGRAPH_TTY
options NETGRAPH_UI
Sysctl
net.inet6.ip6.auto_linklocal=0
net.inet6.ip6.auto_linklocal=0
#
net.isr.dispatch=deferred
#
dev.igb.0.rx_processing_limit=4096
dev.igb.1.rx_processing_limit=4096
dev.igb.2.rx_processing_limit=4096
dev.igb.3.rx_processing_limit=4096
dev.igb.4.rx_processing_limit=4096
dev.igb.5.rx_processing_limit=4096
dev.igb.6.rx_processing_limit=4096
dev.igb.7.rx_processing_limit=4096
#
net.link.lagg.default_use_flowid=1
#
net.inet.ip.dummynet.pipe_slot_limit=1000
net.inet.ip.dummynet.io_fast=1
net.inet.ip.intr_queue_maxlen=10240
#
kern.ipc.nmbclusters=262144
kern.ipc.maxsockbuf=16777216
kern.ipc.somaxconn=32768
kern.randompid=348
net.inet.icmp.icmplim=50
net.inet.ip.process_options=0
net.inet.ip.redirect=0
net.inet.icmp.drop_redirect=1
net.inet.tcp.blackhole=2
net.inet.tcp.delayed_ack=0
net.inet.tcp.drop_synfin=1
net.inet.tcp.msl=7500
net.inet.tcp.nolocaltimewait=1
net.inet.tcp.path_mtu_discovery=0
net.inet.tcp.recvbuf_max=16777216
net.inet.tcp.recvspace=64395
net.inet.tcp.sendbuf_max=16777216
net.inet.tcp.sendspace=64395
net.inet.udp.blackhole=1
net.inet.tcp.tso=0
net.inet.tcp.syncookies=1
net.inet.ip.ttl=226
net.inet.tcp.drop_synfin=1
net.inet.ip.accept_sourceroute=0
net.inet.icmp.bmcastecho=0
net.route.netisr_maxqlen=4096
net.graph.maxdgram=8388608
net.graph.recvspace=8388608
loader.conf
kern.geom.label.gptid.enable=0
kern.geom.label.disk_ident.enable=0
#
hw.igb.rxd=4096
hw.igb.txd=4096
hw.igb.max_interrupt_rate=32000
#
net.route.netisr_maxqlen=4096
net.isr.defaultqlimit=4096
net.link.ifqmaxlen=10240
rc.firewall
${f} -f flush
${f} add 50 allow tcp from any to me 22 via lagg1
${f} add 51 allow tcp from me 22 to any via lagg1
#${f} add 65 allow tcp from any to me 1723
#${f} add 65 allow tcp from me 1723 to any
#${f} add 65 allow gre from any to me
#${f} add 65 allow gre from me to any
#
#
# PRIVATBANK + LIQPAY FREE ACCESS
${f} add 66 allow tcp from not "table(0)" to "table(17)" dst-port 80,443
#
# Blocked URL
${f} add 67 fwd 127.0.0.1,8082 tcp from "table(0)" to "table(18)" dst-port 80 in
${f} add 68 reject tcp from "table(0)" to "table(18)"
${f} add 69 deny ip from "table(0)" to "table(18)"
#
# DENY TRACEROUTE & PING
${f} add 70 allow ip from any to any via lo0
${f} add 71 allow icmp from 10.10.1.1 to any
${f} add 72 allow icmp from any to 10.10.1.1
${f} add 74 deny icmp from me to any
${f} add 75 deny icmp from 10.10.0.0/24 to 10.190.0.0/16 icmptype 0,11
${f} add 76 deny icmp from any to me
${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me
#
${f} add 170 allow tcp from any to ${main_server} 80,443
${f} add 175 allow tcp from ${main_server} 80,443 to any
${f} add 180 allow tcp from any to ${main_server} 80,443
${f} add 185 allow tcp from ${main_server} 80,443 to any
${f} add 187 allow tcp from any to ${site_server} 80
${f} add 188 allow tcp from ${site_server} 80 to any
${f} add 190 allow udp from any to ${dns} 53
${f} add 195 allow udp from ${dns} 53 to any
${f} add 200 skipto 500 ip from any to any via lagg1
# message module========
${f} add 280 fwd 127.0.0.1,8081 tcp from "table(35)" to not me dst-port 80 in
${f} add 290 fwd 127.0.0.1,8080 tcp from not "table(0)" to not me dst-port 80 in
#=======================
${f} add 300 skipto 4500 ip from any to any in
${f} add 400 skipto 450 ip from any to any recv lagg1
${f} add 420 tee 1 ip from any to any
${f} add 450 tee 2 ip from any to "table(0)"
${f} add 490 allow ip from any to any
${f} add 500 skipto 32500 ip from any to any in
${f} add 510 tee 1 ip from any to any
${f} add 540 allow ip from any to any
${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any
${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2030 allow ip from ${bras_server} to any
${f} add 2050 deny ip from any to any via lagg1
${f} add 2060 allow udp from any to any 53,7723
${f} add 2100 deny ip from any to any
${f} add 32490 deny ip from any to anynofire.pl добавляет правила:
05000 skipto 33010 ip from table(1) to table(37)
05001 skipto 33010 ip from table(37) to table(1)
05002 deny ip from not table(0) to any
05003 skipto 5010 ip from table(127) to table(126)
05004 skipto 5030 ip from any to not table(2)
05005 deny ip from any to not table(1)
05006 pipe tablearg ip from table(21) to any
05007 deny ip from any to any
05010 pipe tablearg ip from table(127) to any
05030 deny tcp from table(15) to any 25
05400 pipe tablearg ip from table(11) to any
32000 deny ip from any to any
32490 deny ip from any to any
33000 pipe tablearg ip from table(126) to table(127)
33001 skipto 33010 ip from not table(2) to any
33002 pipe tablearg ip from any to table(20)
33003 deny ip from any to any
33400 pipe tablearg ip from any to table(10)
Вот эти два правила, удалив которые все работает без проблем:
33002 pipe tablearg ip from any to table(20)
33400 pipe tablearg ip from any to table(10)
Подскажите, что может давать такую ошибку - при том, что на старой версии FreeBSD 7.4 все работает нормально.
С меня бутылка хорошего горячительного средства или скажите сколько если устали пить
