ipfw kernel NAT performance much worse in 11-Stable than 10-Stable

[Andrey V. Elsukov]

On 31.08.2017 15:10, Graham Menhennitt wrote:
> On 10-Stable, the interface is re1. The output of 'ifconfig re1 | grep
> options' is:
> options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE>
> 
>     nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
> 
> On 11-Stable (the one with the problems), it's igb1 and the output of
> 'ifconfig igb1 | grep options' is:
> options=6403bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
> 
>     nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
> 

You need to disable TSO on your interface, ipfw nat is not compatible
with TCP segmentation offloading (this is noted in ipfw(8) BUGS section).

Try to use:
ifconfig igb1 -vlanhwtso -tso4

You can add these option to "ifconfig_igb1" variable in rc.conf.

-- 
WBR, Andrey V. Elsukov

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 553 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-ipfw/attachments/20170831/0812ed31/attachment.sig>