CURRENT: ipfw: problems with timeouts and worse network performance

O. Hartmann ohartman at zedat.fu-berlin.de
Fri May 20 12:03:35 UTC 2016


With most recent CURRENT (r300295) I face a very strange behaviour on
all systems running CURRENT with IPFW enabled.

I realize massive network problems, especially when services like
claws-mail, pgadmin3, OpenLDAP clients, drill or even svn try to
connect to their servers. In most cases, the connection couln't be
established due to timeouts, but repeating, like performing svn
in /usr/src gives some results, but this is highly erratic.

The problems vanishes when "ipfw disable firewall" is entered. We use
both custom ipfw-rule-scripts as well as those used with rc.conf
(mostly type WORKSTATION).

The problem is prominet with having /usr/src and /usr/ports updated via
subversion. In 99% of the cases svn drops out with timeouts in case
IPFW is active - but everything seems all right when ipfw is disabled.

As far as I could see this problem affects all CURRENT we use and it is
not NIC specific, but sticks with IPFW. 

I reported earlier about broken pipes in ssh sessions to remote hosts,
which occur on an erratic basis. i'm investigating this problem now and
it seems that it is also ipfw-related, but I'm not sure. This problem
is present since a couple of weeks now.

Is there anything known about ipfw problems?

Kind regards,
Oliver


More information about the freebsd-current mailing list