Shorewall users - Apr 2005 - Througput problems behind firewall

Hi

I have a atrange problem and don''t know where to look anymore. 

I have 4 interfaces running on RHE3 on a Dell XEON server 2.8Ghz 1Gb RAM.
The primary use (only one at this stage) is for the server to handle mac
address authentication of clients which it does.  The problem however has to
do with througput.

I have 3 DMZ''s which one is a private range doing masquarading and One
Interface connected to the Internet side of my configuration. The other 2
does IP Forwarding.
For tests purposes I have a machine on the same side on the Internet running
a bandiwdth test program.

When I access that program from my DMZ''s the througput is never above
100Kbps.  When I access that program from within my private range (the
masquarading one) I get fully LAN speeds.  (50-100 Mbbps)

Have anyone any idea of what the problem can be?

I have ran the shorewall clear command, but symptoms is exactly the same.  I
have rebuilded the server with different operating system, but still no joy.

	
10.0.0.9
192.168.0.1
-------------
   DMZa   =========			   			   |
|
---------|		 |		        |------------------|   BW
Test   |
10.0.1.1 |		 |			  |			   |
server   |
   DMZb  |		 |10.0.0.8     |----------|
-------------
---------|	FW	 |-------------|	SWHITCH |
10.0.0.2 |	Server |		   |----------|
   DMZc  |		 |
---------|		 |
          ========

 	

Christo Louw 
Technical Operations Manager 	
Intra Data Communication	
Phone +258 1 49 4850    Fax +258 1 49 4968
Mobile MZ +258 (0) 84 402 469
Mobile SA +27 (0) 82 823 4683
www.intra.co.mz	
________________________________

	
Everything in this e-mail and attachments relating to the official business
of Intra LDA ("Intra") is proprietary to Intra. It is confidential,
legally
privileged and protected by law. Intra does not own and endorse any other
content. Views and opinions are those of the sender unless clearly stated as
being that of Intra. The person addressed in the e-mail is the sole
authorised recipient. Please notify the sender immediately if it has
unintentionally reached you and do not read, disclose or use the content in
any way. Intra cannot assure the integrity of this communication and
attachments has been maintained nor that it is free of errors, viruses,
interception or interference. Accordingly, no liability or responsibility
whatsoever is accepted if information or data is, for whatever reason,
corrupted or does not reach its intended destination.

Christo Louw wrote:
> 
> When I access that program from my DMZ''s the througput is never
above
> 100Kbps.  When I access that program from within my private range (the
> masquarading one) I get fully LAN speeds.  (50-100 Mbbps)
> 
> Have anyone any idea of what the problem can be?
> 
> I have ran the shorewall clear command, but symptoms is exactly the same. 
I
> have rebuilded the server with different operating system, but still no
joy.
A couple of things:

a) Be sure that everyone is using the same MTU.
b) Check for high error rates using the command "ip -s link ls"

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

Hi Tom

I don''t see anything out of the ordinary..

1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    RX: bytes  packets  errors  dropped overrun mcast
    233282     1439     0       0       0       0
    TX: bytes  packets  errors  dropped carrier collsns
    233282     1439     0       0       0       0
8: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:02:b3:d4:d2:96 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast
    45781882   19690583 0       0       0       83
    TX: bytes  packets  errors  dropped carrier collsns
    369653658  17383346 0       0       0       0
9: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:02:b3:d4:d1:03 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast
    199333369  1409046  0       0       0       149
    TX: bytes  packets  errors  dropped carrier collsns
    704055467  1075899  0       0       0       0
10: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:02:b3:d4:d3:5e brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast
    1229755769 5950442  0       0       0       149
    TX: bytes  packets  errors  dropped carrier collsns
    4192024072 7799160  0       0       0       0
11: eth3: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 2000
    link/ether 00:02:b3:d4:d0:58 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast
    1331450897 5331603  0       0       0       160
    TX: bytes  packets  errors  dropped carrier collsns
    3223126193 4996374  0       0       0       0
12: eth4: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:02:b3:d2:2a:94 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast
    1308895652 3983791  0       0       0       149
    TX: bytes  packets  errors  dropped carrier collsns
    2723090221 3770633  0       0       0       0
13: eth5: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0b:db:92:43:4f brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast
    891442781  3972100  0       0       0       149
    TX: bytes  packets  errors  dropped carrier collsns
    2334199238 3835919  0       0       0       0

 


 	
Christo Louw 
Technical Operations Manager 	
Intra Data Communication	
Phone +258 1 49 4850    Fax +258 1 49 4968
Mobile MZ +258 (0) 84 402 469 
Mobile SA +27 (0) 82 823 4683
www.intra.co.mz 	
________________________________

Everything in this e-mail and attachments relating to the official business
of Intra LDA ("Intra") is proprietary to Intra. It is confidential,
legally
privileged and protected by law. Intra does not own and endorse any other
content. Views and opinions are those of the sender unless clearly stated as
being that of Intra. The person addressed in the e-mail is the sole
authorised recipient. Please notify the sender immediately if it has
unintentionally reached you and do not read, disclose or use the content in
any way. Intra cannot assure the integrity of this communication and
attachments has been maintained nor that it is free of errors, viruses,
interception or interference. Accordingly, no liability or responsibility
whatsoever is accepted if information or data is, for whatever reason,
corrupted or does not reach its intended destination.	

-----Original Message-----
From: shorewall-users-bounces@lists.shorewall.net
[mailto:shorewall-users-bounces@lists.shorewall.net] On Behalf Of Tom Eastep
Sent: Wednesday, April 20, 2005 4:03 PM
To: Mailing List for Shorewall Users
Subject: Re: [Shorewall-users] Througput problems behind firewall

Christo Louw wrote:
> 
> When I access that program from my DMZ''s the througput is never
above
> 100Kbps.  When I access that program from within my private range (the 
> masquarading one) I get fully LAN speeds.  (50-100 Mbbps)
> 
> Have anyone any idea of what the problem can be?
> 
> I have ran the shorewall clear command, but symptoms is exactly the 
> same.  I have rebuilded the server with different operating system, but
still no joy.

A couple of things:

a) Be sure that everyone is using the same MTU.
b) Check for high error rates using the command "ip -s link ls"

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key
_______________________________________________
Shorewall-users mailing list
Post: Shorewall-users@lists.shorewall.net
Subscribe/Unsubscribe:
https://lists.shorewall.net/mailman/listinfo/shorewall-users
Support: http://www.shorewall.net/support.htm
FAQ: http://www.shorewall.net/FAQ.htm

Christo Louw wrote:
> I don''t see anything out of the ordinary..
Nor do I.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key