Jail - PF - NAT - Network Performance

[Kristof Provost]

> On 25 Oct 2015, at 18:47, James Lodge <James at Lodge.me.uk> wrote:
> 
>> On 25 Oct 2015, at 17:46, James Lodge <James at Lodge.me.uk> wrote:
>> I currently have a FreeBSD 10.1 host running on Digital Ocean. I have multiple jails and I'm not using vimage.
>> 
>> 
>> I'm using PF on the host to NAT traffic from said jails and all is working as expected. I have a jail running OpenVPN and clients can connect and traffic is routed to the Internet down the tunnel via PF/NAT. The issue I'm seeing is download speeds to the client from the Internet on the external side on PF. Upload always seem reasonable, but download is always woeful. I'm using a Windows machine as the client if that make any odds.
>> 
>> Yeah, there’s an issue with checksums and pf/Xen.
>> Disabling TSO should work for you (sudo sysctl net.inet.tcp.tso=0), and the problem should be completely fixed in the >next release (10.3 or 11.0)
>> 
>> Regards,
>> Kristof
> 
> 
> Thanks Kristof for the quick reply,
> 
> I was hoping it would be that simple, but Digital Ocean use KVM (from what I know) as their hypervisor so disabling TSO and LRO seems to have no noticed increase in performance. 
> 
Can you run a tcpdump while you’re seeing the problem?
The issue I know about is related to the TCP checksum, so I’d expect to see many invalid checksums.

Regards,
Kristof