pashaumka

2013-12-11 21:15:54

на брасе

в квагге zebra.conf

ip route 91.219.169.64/27 Null0 254

в маршрутах

91.219.169.64/27 127.0.0.1 U1B 0 21918 lo0

на БГП

в zebra.conf

ip route 10.36.0.0/16 91.219.168.36
ip route 91.219.169.64/27 91.219.168.36

root@bgp:/home/admin# netstat -rn | grep 91.219.168.36
10.36.0.0/16 91.219.168.36 UG1 0 3560033 vlan37
91.219.169.64/27 91.219.168.36 UG1 0 778032821 vlan37

тут всё пучком...

2013-12-11 20:48:05

в 10.0 уже smp-pf

2013-12-11 19:05:21

Доброго времени суток

Гуру FreeBSD - спасите от убийства чертей на серверах!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

это пипец -- или я заколдован или сервера... вроде как 15 лет с фряхой ( с 3.2 начинал)

поставил на сервер 11.0-current от 05-дек-2013

залил конфиг Pf, фаервола, mpd5

железо - supermicro mbd-x9dri-f-0

проц Intel® Xeon® CPU E5-2650 0 @ 2.00GHz (2000.04-MHz K8-class CPU) - 8 ядерный. гипертрединг отключен. VT-d туда-же

16 гигов памяти

ОС: фря 11-0 current ( head-05-12 )

установлена пока БРАСом

стоит квагга ( OSPFом )

проблема - пакетный фильтр не пропускает нат - всё подвисает в нем.....

не долго говоря... вот конфиги..

loader.conf

------------------------------------

hw.igb.rxd=4096
hw.igb.txd=4096
hw.igb.max_interrupt_rate=32000
hw.igb.rx_process_limit=2048
hw.igb.num_queues=2
hw.igb.lro=0
hw.igb.fc_setting=0

## https://calomel.org/network_performance.html

autoboot_delay="10"           # reduce boot menu delay from 10 to 3 seconds
#if_mxge_load="YES"           # load the Myri10GE kernel module on boot
#loader_logo="beastie"           # old FreeBSD logo menu

net.isr.dispatch="deffered"       # direct / hybrid / deffered // Interrupt handling via multiple CPU, but with context switch.
net.inet.ip.fastforwarding="0"       # packets are forwarded directly to the appropriate network interface with a min validity checking, which greatly improves the throughput

# syncache Hash table tuning
net.inet.tcp.syncache.hashsize=1024   # syncache hash size
net.inet.tcp.syncache.bucketlimit=512   # syncache bucket limit
net.inet.tcp.syncache.cachelimit=65536

net.inet.tcp.tcbhashsize=32768       # tcb hash size
net.isr.bindthreads=0           # do not bind threads to CPUs
net.isr.direct=0           # interrupt handling via multiple CPU
net.isr.direct_force=0           # "
net.isr.maxthreads=2           # Max number of threads for NIC IRQ balancing (4 cores in box)
net.isr.defaultqlimit=4096
net.isr.maxqlimit="2048"
net.link.ifqmaxlen=1024

#vm.kmem_size=214748364    # 2 gbyte   # physical memory available for kernel (320Mb by default)
kern.maxusers=2048
#accf_data_load="YES"           # built in kernel
#accf_http_load="YES"           # built in kernel

net.isr.defaultqlimit="4096"
net.link.ifqmaxlen="10240"

# netgraph queue sizes tuning, see vmstat -z|egrep 'ITEM|NetGraph'
# http://sourceforge.net/p/mpd/discussion/44692/thread/de6a8876
net.graph.maxdata=32768   # 15120
net.graph.maxalloc=32768 # 12048

kern.random.sys.harvest.ethernet=0   #��
kern.random.sys.harvest.interrupt=0   #�� random
kern.random.sys.harvest.point_to_point=0

# Interrupt handling via multiple CPU, but with context switch.
# direct / hybrid / deffered
net.isr.dispatch=deffered

# packets are forwarded directly to the appropriate network interface with a min validity checking, which greatly improves the throughput
net.inet.ip.fastforwarding=1

kern.ipc.nmbclusters=262144
kern.ipc.maxsockets=16384
kern.maxusers=2048
kern.ipc.maxpipekva=320000
kern.maxfiles=204800
kern.maxfilesperproc=200000

net.inet.tcp.syncache.hashsize=1024
net.inet.tcp.syncache.bucketlimit=100
net.inet.tcp.tcbhashsize=4096
kern.ipc.nsfbufs=10240
vm.kmem_size=2G

net.inet.raw.maxdgram=16384
net.inet.raw.recvspace=16384

# for other protocols (IP & PPPoE?)
net.isr.defaultqlimit=4096
net.link.ifqmaxlen=10240
kern.ipc.nmbclusters=400000
kern.ipc.maxsockbuf=83886080

net.inet.ip.dummynet.pipe_slot_limit=1000
net.inet.ip.dummynet.io_fast=1

vm.pmap.pg_ps_enabled=1

# Incresed hostcache
net.inet.tcp.hostcache.hashsize="16384"
net.inet.tcp.hostcache.bucketlimit="100"

# TCP control-block Hash table tuning
net.inet.tcp.tcbhashsize=4096

kern.ipc.shmmax=67108864 #��. ��
net.inet.ip.intr_queue_maxlen=8192 #�� ip-��
net.inet.ip.fw.one_pass=0 #��, �� , � ��
dev.igb.0.enable_lro=0 #�� large receive offloading
dev.igb.1.enable_lro=0
dev.igb.0.enable_aim=0 #��
dev.igb.1.enable_aim=0
dev.igb.0.rx_processing_limit=2048 #�� polling, ��
dev.igb.0.flow_control=0 #��
dev.igb.1.rx_processing_limit=2048
dev.igb.1.flow_control=0

hw.igb.num_queues=8

device.hints

=========================================

# POWER SAVING: https://wiki.freebsd.org/TuningPowerConsumption
hint.p4tcc.0.disabled="1" # Disable CPU Frequency Thermal Control
hint.acpi_throttle.0.disabled="1" # Disable CPU throtling
hint.hpet.0.legacy_route="1" # HPET will steal IRQ0 of i8254 timer and IRQ8 of RTC
hint.apic.0.clock="0" # Disable local APIC timers
hint.atrtc.0.clock="0" # Disable RTC timer
hint.attimer.0.clock=0 # Disable AT timer

rc.conf

==============================================

ifconfig_igb1="inet 10.c.ccc.vvv/26 descr iface_ibg1_2_noc -rxcsum -txcsum -lro -tso -vlanhwtso up"
ifconfig_igb0="inet 10.b.bbb.bbb32 descr iface_igb0_2_users -rxcsum -txcsum -lro -tso -vlanhwtso up"

sysctl.conf

===============================================

net.inet.udp.recvspace=262144

net.inet.tcp.blackhole=1
net.inet.udp.blackhole=1
kern.ipc.somaxconn=4096
kern.maxfiles=204800
kern.maxfilesperproc=200000
net.inet.ip.portrange.first=1024
net.inet.ip.portrange.last=65535
net.inet.ip.portrange.randomized=0
net.inet.tcp.maxtcptw=40960
net.inet.tcp.msl=30000
net.inet.tcp.syncookies=1
net.inet.tcp.nolocaltimewait=1
net.inet.tcp.fast_finwait2_recycle=1

net.inet.raw.maxdgram=16384
net.inet.raw.recvspace=16384
net.inet.ip.redirect=0

kern.ipc.maxsockbuf=2621440
net.graph.recvspace=1024000
net.graph.maxdgram=1024000

net.inet.ip.forwarding=1
net.inet.ip.fastforwarding=0 # �� netisr ��
net.inet.ip.redirect=0
net.inet.tcp.delayed_ack=0
net.inet.tcp.sendspace=3217968
net.inet.tcp.recvspace=3217968
net.inet.tcp.blackhole=2
net.inet.tcp.drop_synfin=1
net.inet.udp.recvspace=65535
net.inet.udp.maxdgram=57344
net.inet.udp.blackhole=1
net.inet.icmp.drop_redirect=1
kern.ipc.nmbclusters=400000
kern.ipc.somaxconn=8192
kern.ipc.maxsockbuf=83886080
#kern.ipc.maxsockets=204800
net.local.stream.recvspace=65535
net.local.stream.sendspace=65535
net.link.ether.inet.proxyall=0
net.link.ifqmaxlen=10240
net.graph.maxdgram=8388608
net.graph.recvspace=8388608
net.inet.tcp.tso=0
net.inet.icmp.icmplim=2000

net.graph.maxdgram=8388608
net.graph.recvspace=8388608
kern.ipc.maxsockbuf=83886080

dev.igb.0.rx_processing_limit=4096
dev.igb.1.rx_processing_limit=4096

net.inet.ip.dummynet.hash_size=16384

### http://abills.net.ua/forum/viewtopic.php?f=1&t=4873

kern.eventtimer.timer=HPET

pf.conf

======================================================

ext_if="vlan372"
int_if="vlan372"
ext_ip="91.219.168.36"
int_net="10.36.0.0/21"
set optimization normal
#set loginterface vlan372
set limit states 800000000
set limit src-nodes 10000000
set limit frags 64000
#set limit tables 2000
set limit table-entries 10000
set skip on lo0
scrub in
scrub out all max-mss 1400

#http://prefetch.net/articles/monitoringpf.html

nat on vlan372 from 10.36.0.0/21 to 91.219.168.0/26 -> 91.219.168.36

nat on vlan372 from 10.36.0.0/21 to any -> 91.219.169.64/27 source-hash #��

pass on 'tun*'
pass on 'ng*'
pass on lo0
pass on $int_if
pass on $int_if proto ipv6
antispoof quick for $ext_if

mpd5

set ippool add gray_pool 10.36.0.0 10.36.7.255

ipfw - только таблицы шейперов

pf.conf - чисто нат

================================

ext_if="vlan372"
int_if="vlan372"
ext_ip="91.219.168.36"
int_net="10.36.0.0/21"
set optimization normal
#set loginterface vlan372
set limit states 800000000
set limit src-nodes 10000000
set limit frags 64000
#set limit tables 2000
set limit table-entries 10000
set skip on lo0
scrub in
scrub out all max-mss 1400

#http://prefetch.net/articles/monitoringpf.html

nat on vlan372 from 10.36.0.0/21 to 91.219.168.0/26 -> 91.219.168.36

nat on vlan372 from 10.36.0.0/21 to any -> 91.219.169.64/27 source-hash #натируем пулом адресов

pass on 'tun*'
pass on 'ng*'
pass on lo0
pass on $int_if
pass on $int_if proto ipv6
antispoof quick for $ext_if

в ядре.

amd64

INET6 - мы раздаем ipv6

FLOWTABLE удален

RUTERTABLES=1

trafshow -ing5

=================

10.36.0.5,58397                           224.0.0.252,5355                          17               104
10.36.0.5,53905                           224.0.0.252,5355                          17               104
10.36.0.5,49197                           77.234.40.86,443                          6                52
10.36.0.5,49196                           173.194.39.180,443                        6                52
10.36.0.5,49193                           173.194.39.128,443                        6                52
10.36.0.5,49198                           87.240.143.244,80                         6                52
10.36.0.5,49194                           173.194.39.180,443                        6                52
10.36.0.5,49195                           173.194.39.128,443                        6                52

и кипящий телефон в офисе.....

==================================================================

ГДЕ КОПАТЬ, ГДЕ ЭТА С...КА ЗАРЫЛАСЬ??????????

возможно - перемудрил...

2013-11-27 20:42:36

1300 выгребаю

2010-06-21 05:51:18

самописный биллинг: PHP + web

2010-06-18 06:39:52

http://dlab.od.ua - мега девайсы!

Увійти

pashaumka

Всього повідомлень

Приєднався

Останній візит

Дней в лидерах

Тип контенту

Профили

Форум

Календарь

Сообщения додав pashaumka

Пакетный фильтр

Пакетный фильтр

Пакетный фильтр

Продам корпус 2U Supermicro SC825 2x700W Hot Swap

Вопрос. у кого какой биллинг?

UPS для свічів

Спільнота

Активність