CURRENT: ipfw: problems with timeouts and worse network performance

From: O. Hartmann <ohartman_at_zedat.fu-berlin.de>
Date: Fri, 20 May 2016 14:01:52 +0200
With most recent CURRENT (r300295) I face a very strange behaviour on
all systems running CURRENT with IPFW enabled.

I realize massive network problems, especially when services like
claws-mail, pgadmin3, OpenLDAP clients, drill or even svn try to
connect to their servers. In most cases, the connection couln't be
established due to timeouts, but repeating, like performing svn
in /usr/src gives some results, but this is highly erratic.

The problems vanishes when "ipfw disable firewall" is entered. We use
both custom ipfw-rule-scripts as well as those used with rc.conf
(mostly type WORKSTATION).

The problem is prominet with having /usr/src and /usr/ports updated via
subversion. In 99% of the cases svn drops out with timeouts in case
IPFW is active - but everything seems all right when ipfw is disabled.

As far as I could see this problem affects all CURRENT we use and it is
not NIC specific, but sticks with IPFW. 

I reported earlier about broken pipes in ssh sessions to remote hosts,
which occur on an erratic basis. i'm investigating this problem now and
it seems that it is also ipfw-related, but I'm not sure. This problem
is present since a couple of weeks now.

Is there anything known about ipfw problems?

Kind regards,
Oliver
Received on Fri May 20 2016 - 10:03:35 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:41:05 UTC