similar to: Firewall sizing guidelines?

I *think* we are finally making some progress in tracking our elusive performance problems. After employing a second 10Mb link from our ISP, along with another firewall box and proxy, we were able to determine the problem *is* our firewall. We don''t know exactly why yet, but our sporadic slow web access seems to have gone away since swapping a new firewall in this morning. The

Ok here are all the information the website said I should include first: [root@residents root]# shorewall version 1.4.8 [root@residents root]# ip addr show 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo 2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100

Hello I''ve setuped a bridge with l7-filter and ipp2p. We have every day + or - between 10Mbits and 30 Mbits P2P traffic from + or - 450 customers. When traffic increase. I''ve got this kind of error message : Feb 23 14:26:19 gestor1 kernel: printk: 38 messages suppressed. Feb 23 14:26:19 gestor1 kernel: ip_conntrack: table full, dropping packet. The server is celeron

xen-3.0.3-94.el5_4.2 2.6.18-164.6.1.el5xen RHEL5.4 x86_64 I''ve got a dom0 that does nothing but have a DomU created. The DomU gets plenty of load. Over time, the dom0''s ipconntrack table fills up but not the DomU. Once it gets full I can restart iptables and it''s fine. The strange thing is this only happens on hosts I have provided (hardware and hosting) from one

https://bugzilla.netfilter.org/show_bug.cgi?id=830 Summary: ??iptables????????? Product: iptables Version: unspecified Platform: All OS/Version: RedHat Linux Status: NEW Severity: major Priority: P5 Component: iptables AssignedTo: netfilter-buglog at lists.netfilter.org ReportedBy: higkoohk

In the panic of replacing our firewall(s) earlier in the week, we ended up moving our original shorewall 1.4 config onto a machine with 2.0.10 already installed, overwriting all the 2.0.10 config files. Most things seem to work fine, except for our masq entries. I''ve examined the default 2.0.10 files compared with our 1.4 files, and can''t spot the problem. What am I missing?

Hi, my ip_conntrack table is filling up and now my server is dropping packets. I'm running CentOS release 4.4 (Final) on a fairly busy webserver. The table is full of various connections, including a lot of "ESTABLISHED" tcp connections from my webserver (the src is my webserver ip), and some other random connections to my webserver, and many "ASSURED" connections. So why

Hey guys, I have several Linux routers in place at high-usage locations (student apartment complexes). I''m having trouble with some of the routers which use 6Mbit DSL lines as their Internet feed. The routers use PPPoE and perform NAT. During peak usage periods, the routers are dropping alot of packets. I''m lead to believe this is because there are too many active

>From: "Shawn Wright" <swright@sls.bc.ca> >Subject: [Shorewall-users] Finally making some progress >I *think* we are finally making some progress in tracking our elusive >performance problems. After employing a second 10Mb link from our ISP, >along with another firewall box and proxy, we were able to determine the >problem *is* our firewall. We don''t

I was trying to do what the article at http://www.austintek.com/LVS/LVS-HOWTO/HOWTO/LVS-HOWTO.performance.html#conntrack_filling_tables <http://www.austintek.com/LVS/LVS-HOWTO/HOWTO/LVS-HOWTO.performance.html#conntrack_filling_tables%3C/blockquote%3E%3C/div%3E> suggested My iptables rules are ------------------------------------------------------------------------ #that's what the

I''ve been having all sorts of problems the last few days with my connection slowing down and then stopping working. Rebooting the router box always fixes it for a while. When I couldn''t hit any pages this morning, and couldn''t even ssh into the router, I dug around a little. When I did a dmesg on the router, there were a bunch of errors saying: ip_conntrack: table full,

Hi all, I''m searching for a tutorial how to setup multiple network cards with xen network bridge setup in debian lenny. My problem is, bridges seams only to work if i put an ip adress in dom0 to them. Thanks, Alex _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users

https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=105 laforge@netfilter.org changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |LATER ------- Additional Comments From

Hi all. i'm trying to modify some parameters but when system reboots it doesn't load. For the sysctl if I run sysctl -p then it changes /etc/sysctl.conf net.ipv4.netfilter.ip_conntrack_max = 1048576 /etc/modprobe.conf options ip_conntrack hashsize=131072 after reboot results cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max 65536 cat

https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=105 ------- Additional Comments From laforge@netfilter.org 2003-06-24 20:00 ------- Did you try to enlarge your connection tracking table? (Pleae read the FAQ) Do the /proc/net/ip_conntrack entries look plausible, or are there lots of entries with unreasonably high timeout? ------- You are receiving this mail because: -------

Hi to all. I have a shorewall ver 2.0.13 running in Fedora Core 3, the machine has dual cpu, 1gb of ram, and 40GB of hard disk space. The machine runs shorewall only and had tested it to openvpn but most of the time just shorewall. The problem, there were instances when internet traffic coming from the local network just halts, I needed to restart shorewall in order the traffic to flow again.

We have encountered a number of problems with our firewall recently, and the past 24 hours have left me quite concerned. Here is what we are seeing: 1. Original firewall, a PentiumPro/200 with 96Mb RAM, serving approx 500 client PCs for a 10Mb internet connection. Running Mandrake 9.2, we began seeing severe swapping a few weeks, with kernel mem usage exceeding 200Mb. Given an ip_conntrack

Hi all, i need advice how can i limit ip_conntrack per IP. clients of network that i support often uses torrent , DC++ , eMule clients and i have lost packages because they open too many ports. i have traffic control limits but this obviously isn''t enough Any advance how to prevent server from this kind problems will be welcome. Best regards Emil

It''s now been over a week, and we are nearly at wits end trying to track down our performance issues here. We now have a P3/667 (single CPU! SMP was definitely the source of previous lockups) with 256Mb RAM. It is running along with a load avg of less than 0.1 even at peak times. Max ip_conntrack is around 1500-2000. Sounds fine, but, we have also tried 3 different squid proxies (2

Hi! Already searched for it and asked in IRC channel but all replies talk about ip_conntrack_irc and ip_nat_irc. I have a rule in 'NEW' section of 'shorewall/rules' to irc: ACCEPT fw net tcp 6667 #IRC and 'lsmod|grep irc' shows: ip_nat_irc 3648 0 ip_nat 22572 8 [...] ip_conntrack_irc