Shorewall users - Nov 2003 - Firewall slow performance question

Hello All,

I am having troubles with a new firewall.  The performance is very slow.  I
can not access https and 443 is open (may be timing out?)  I can not usably
connect to the box via webmin or ssh.  There is too much delay.

Regular http seems to work.  Any secure connection either does not work at
all or is really slow.



Top shows only 3% max cpu utilization,  Using no swap space, 256MB available
.


I am using:

Shorewall 1.4.6c-1
SuSE 8.2 minimal install
PIII 600, 128 MB Ram  HP Vectra
20 GB Disk
3 x 3com nics  2 active.  DMZ not plugged in yet.


IP ADDR SHOW

1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
    inet6 ::1/128 scope host 
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:40:05:08:e2:c2 brd ff:ff:ff:ff:ff:ff
    inet 10.1.1.1/16 brd 10.1.255.255 scope global eth0
    inet6 fe80::240:5ff:fe08:e2c2/64 scope link 
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:50:04:6c:8b:b5 brd ff:ff:ff:ff:ff:ff
    inet 192.251.181.10/24 brd 192.251.181.255 scope global eth1
    inet6 fe80::250:4ff:fe6c:8bb5/64 scope link 
4: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:10:4b:67:a8:61 brd ff:ff:ff:ff:ff:ff
    inet 172.16.1.1/24 brd 172.16.1.255 scope global eth2
    inet6 fe80::210:4bff:fe67:a861/64 scope link 
5: sit0@NONE: <NOARP> mtu 1480 qdisc noop 
    link/sit 0.0.0.0 brd 0.0.0.0


IP ROUTE SHOW

172.16.1.0/24 dev eth2  proto kernel  scope link  src 172.16.1.1 
192.251.181.0/24 dev eth1  proto kernel  scope link  src 192.251.181.10 
10.1.0.0/16 dev eth0  proto kernel  scope link  src 10.1.1.1 
default via 192.251.181.9 dev eth1 




Any help or ideas would be appreciated.  


Thanks
Bill Roach

-------------- next part --------------
A non-text attachment was scrubbed...
Name: SMC-SW-info.zip
Type: application/octet-stream
Size: 63330 bytes
Desc: not available
Url :
http://lists.shorewall.net/pipermail/shorewall-users/attachments/20031107/b2c24657/SMC-SW-info-0001.obj

On Fri, 7 Nov 2003, Bill Roach wrote:
> Hello All,
>
> I am having troubles with a new firewall.  The performance is very slow.  I
> can not access https and 443 is open (may be timing out?)  I can not usably
> connect to the box via webmin or ssh.  There is too much delay.
>
> Regular http seems to work.  Any secure connection either does not work at
> all or is really slow.
>
And if you "shorewall clear", does this box suddently spring to life?

-Tom
--
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net