NAT performance tweaks

[veedee at c7.campus.utcluj.ro]

On Mon, May 05, 2003 at 12:34:55PM -0500, Eric Anderson wrote:
> Clement Laforet wrote:
> >On Mon, 05 May 2003 09:41:38 -0500
> >Eric Anderson <anderson at centtech.com> wrote:
> >
> >>Does anyone have any tweaks they apply to NAT firewalls that pass a
> >>lot of connections through them?  Here's the ony tweak I have in place
> >>already, but I'm not sure they're needed yet (or if there are any
> >>tweaks needed at all):
> >
> >which NAT solution do you use ?
> 
> IPNAT and ipfilter..
> 
> >>sysctl kern.ipc.somaxconn=8192
> >
> >
> >NAT'ing (except for natd which uses IPDIVERT (but not more than 3))
> >doesn't use socket to translate packets.
> >Generally, packets are tagged by firewall control software and
> >translated within the IP stack (at leat in kernel land).
> 
> Oh yea, that's right.. So can you think of any kernel or other tweaks to 
> be done, to ensure optimal usage of the machine in this environment? 
> What about mail coming in/out of the machine? I do a fair amount of mail 
> through it (out through NAT, in through Sendmail) also..

If you have a large network behind your NAT server, defining LARGE_NAT in
src/contrib/ipfilter/ip_nat.h and src/sys/contrib/ipfilter/netinet/ip_nat.h
might help. Don't forget to recompile the kernel and ipfilter.

Strange enough, I used to have huge pings (up to 80ms in a totally switched
gigabit network) after a few hours of utilization before fiddling with
LARGE_NAT.

> Eric
> 
> 
> --
> ------------------------------------------------------------------
> Eric Anderson	   Systems Administrator      Centaur Technology
> Attitudes are contagious, is yours worth catching?
> ------------------------------------------------------------------

-- 
| Radu Bogdan Rusu | Network Administrator @ campus.utcluj.ro |
| cvsup3.ro/www4.ro.freebsd.org maintainer |->5b736c616d215d<-|
| Faculty of Automation & Computer Science @ UTCluj , Romania |
|-------------------------------------------------------------|