I seriously doubt it's an ipfilter issue, as I tested a bridge mode ipfilter
based firewall (pentium 90, 32 Mb of RAM / OpenBSD), and managed to use most
of the 100Mb network capacity.
Latency also wasn't really an issue.
It may be a problem with your rules, but I can't think off hand, how you could
create a ruleset which would cause a performance hit, without putting a
couple of thousand rules in it.
Which makes me think that something, somewhere isn't quite right.
a) Check that DNS lookups arn't taking too long (a local DNS cache is always a
good way to improve this).
b) Use tcpdump on both interfaces on your firewall to log the packets required
for a web connection.
# tcpdump -i <outside interface> -n -w outside.log 'host <web server>'
# tcpdump -i <inside interface> -n -w inside.log 'host <webserver> and host
<client>'
Setup the above two commands, open up <webserver> on <client> machine.
Kill both of the tcpdumps, go through the log files with a fine toothcomb,
thing to look at, are packets which come in one interface, but do not cause a
corresponding packet to leave the other interface, or packets where there is
a large time difference, or packets which are not port 80 based, which may be
blocked by your firewall.
(To read the log files created by the above two commands: tcpdump -r <file>
<other options>)
-Antony
P.S. I appologise if some of this email is too simplistic or too technical.
On Wednesday 05 February 2003 03:27, Mike Holling wrote:
> > Woops. My reply to this posting addressed the wrong thread/subject. I
> > saw "performance" and started thinking about Mike Holling's problem (and
> > I'm not sure it even applies to his problem).
>
> nope, i have 16 ip addresses in my nat pool which should provide enough
> ip/port combinations for hundreds of thousands of simultaneous
> connections. i still haven't found a solution to my problem,
> unfortunately.
>
> - Mike
*************************************************************************
This e-mail and any attachments may contain confidential or privileged
information. If you are not the intended recipient, please contact the
sender immediately and do not use, store or disclose their contents.
Any views expressed are those of the individual sender and not of Kinetic
Information System Services Limited unless otherwise stated.
www.kinetic.co.uk
