Radek
I’ve found that fast networking is actually CPU & memory intensive.
Pentium 4 and Xeon's are increasingly a necessity for stable firewalls in my
opinion.
Keep in mind OpenBSD is a monolithic kernel & isn’t a one to one ratio with a
commercial router.
What are your context switches & interrupts doing while the VPN is up & traffic
is flowing?
vmstat -w 4
What is your memory high water mark during a peak traffic?
vmstat -m
Regards
Patrick
> On Aug 21, 2019, at 12:34 AM, radek <r...@int.pl> wrote:
>
> Hello Patrick,
> I am sorry for the late reply.
>
>> Do you consider memory an issue?
> No, I do not. I have a bunch of old Soekris/net5501-70 and ALIX2d2/2d3, that
> I use for VPN testing.
> Current testing set (6.5/i386) is net5501-70 <-> ALIX2d3
> Production set (6.3/i386) is net5501-70 <-> ALIX2d2
> Also have tried net5501-70 <-> net5501-70 - the same VPN problem occurs
> It is unlikely that every box has any hardware issue.
>
>> Unix load average can occasionally be deceiving.
> I did not know.
>
> #### net5501-70 ####
> $top -d1 | head -n 4
> load averages: 0.05, 0.01, 0.00 RAC-fw65-test.PRAC 10:58:14
> 38 processes: 1 running, 35 idle, 1 dead, 1 on processor up 3 days, 18:02
> CPU states: 0.5% user, 0.0% nice, 0.4% sys, 0.0% spin, 0.2% intr, 98.8%
> idle
> Memory: Real: 18M/267M act/tot Free: 222M Cache: 97M Swap: 0K/256M
>
> #### ALIX2d3 ####
> $top -d1 | head -n 4
> load averages: 0.00, 0.00, 0.00 mon65.home 07:30:05
> 37 processes: 1 running, 35 idle, 1 on processor up 13:46
> CPU states: 0.3% user, 0.0% nice, 1.1% sys, 0.0% spin, 0.4% intr, 98.3%
> idle
> Memory: Real: 125M/223M act/tot Free: 14M Cache: 47M Swap: 73M/256M
>
>
>
>> What is the speed of your memory?
>> What make of Ethernets are you running?
> Dmesgs below
>
> #### net5501-70 ####
> OpenBSD 6.5 (GENERIC) #2: Tue Jul 23 23:08:46 CEST 2019
> r...@syspatch-65-i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
> real mem = 536363008 (511MB)
> avail mem = 511311872 (487MB)
> mpath0 at root
> scsibus0 at mpath0: 256 targets
> mainbus0 at root
> bios0 at mainbus0: date 20/80/26, BIOS32 rev. 0 @ 0xfac40
> pcibios0 at bios0: rev 2.0 @ 0xf0000/0x10000
> pcibios0: pcibios_get_intr_routing - function not supported
> pcibios0: PCI IRQ Routing information unavailable.
> pcibios0: PCI bus #0 is the last bus
> bios0: ROM list: 0xc8000/0xa800
> cpu0 at mainbus0: (uniprocessor)
> cpu0: Geode(TM) Integrated Processor by AMD PCS ("AuthenticAMD" 586-class)
> 500 MHz, 05-0a-02
> cpu0: FPU,DE,PSE,TSC,MSR,CX8,SEP,PGE,CMOV,CFLUSH,MMX,MMXX,3DNOW2,3DNOW
> mtrr: K6-family MTRR support (2 registers)
> amdmsr0 at mainbus0
> pci0 at mainbus0 bus 0: configuration mode 1 (bios)
> 0:20:0: io address conflict 0x6100/0x100
> 0:20:0: io address conflict 0x6200/0x200
> pchb0 at pci0 dev 1 function 0 "AMD Geode LX" rev 0x33
> glxsb0 at pci0 dev 1 function 2 "AMD Geode LX Crypto" rev 0x00: RNG AES
> vr0 at pci0 dev 6 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 11, address
> 00:00:24:cb:4f:cc
> ukphy0 at vr0 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
> 0x004063, model 0x0034
> vr1 at pci0 dev 7 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 5, address
> 00:00:24:cb:4f:cd
> ukphy1 at vr1 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
> 0x004063, model 0x0034
> vr2 at pci0 dev 8 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 9, address
> 00:00:24:cb:4f:ce
> ukphy2 at vr2 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
> 0x004063, model 0x0034
> vr3 at pci0 dev 9 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 12, address
> 00:00:24:cb:4f:cf
> ukphy3 at vr3 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
> 0x004063, model 0x0034
> glxpcib0 at pci0 dev 20 function 0 "AMD CS5536 ISA" rev 0x03: rev 3, 32-bit
> 3579545Hz timer, watchdog, gpio, i2c
> gpio0 at glxpcib0: 32 pins
> iic0 at glxpcib0
> pciide0 at pci0 dev 20 function 2 "AMD CS5536 IDE" rev 0x01: DMA, channel 0
> wired to compatibility, channel 1 wired to compatibility
> wd0 at pciide0 channel 0 drive 0: <SanDisk SDCFH-008G>
> wd0: 1-sector PIO, LBA48, 7629MB, 15625216 sectors
> wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 2
> pciide0: channel 1 ignored (disabled)
> ohci0 at pci0 dev 21 function 0 "AMD CS5536 USB" rev 0x02: irq 15, version
> 1.0, legacy support
> ehci0 at pci0 dev 21 function 1 "AMD CS5536 USB" rev 0x02: irq 15
> usb0 at ehci0: USB revision 2.0
> uhub0 at usb0 configuration 1 interface 0 "AMD EHCI root hub" rev 2.00/1.00
> addr 1
> isa0 at glxpcib0
> isadma0 at isa0
> com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
> com0: console
> com1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
> pckbc0 at isa0 port 0x60/5 irq 1 irq 12
> pckbc0: unable to establish interrupt for irq 12
> pckbd0 at pckbc0 (kbd slot)
> wskbd0 at pckbd0: console keyboard
> pcppi0 at isa0 port 0x61
> spkr0 at pcppi0
> nsclpcsio0 at isa0 port 0x2e/2: NSC PC87366 rev 9: GPIO VLM TMS
> gpio1 at nsclpcsio0: 29 pins
> npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
> usb1 at ohci0: USB revision 1.0
> uhub1 at usb1 configuration 1 interface 0 "AMD OHCI root hub" rev 1.00/1.00
> addr 1
> vscsi0 at root
> scsibus1 at vscsi0: 256 targets
> softraid0 at root
> scsibus2 at softraid0: 256 targets
> root on wd0a (2bf8b7abbbce37df.a) swap on wd0b dump on wd0b
>
>
> #### ALIX2d3 ####
> OpenBSD 6.5 (GENERIC) #2: Tue Jul 23 23:08:46 CEST 2019
> r...@syspatch-65-i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
> real mem = 267931648 (255MB)
> avail mem = 247779328 (236MB)
> mpath0 at root
> scsibus0 at mpath0: 256 targets
> mainbus0 at root
> bios0 at mainbus0: date 11/05/08, BIOS32 rev. 0 @ 0xfd088
> pcibios0 at bios0: rev 2.1 @ 0xf0000/0x10000
> pcibios0: pcibios_get_intr_routing - function not supported
> pcibios0: PCI IRQ Routing information unavailable.
> pcibios0: PCI bus #0 is the last bus
> bios0: ROM list: 0xe0000/0xa800
> cpu0 at mainbus0: (uniprocessor)
> cpu0: Geode(TM) Integrated Processor by AMD PCS ("AuthenticAMD" 586-class)
> 499 MHz, 05-0a-02
> cpu0: FPU,DE,PSE,TSC,MSR,CX8,SEP,PGE,CMOV,CFLUSH,MMX,MMXX,3DNOW2,3DNOW
> mtrr: K6-family MTRR support (2 registers)
> pci0 at mainbus0 bus 0: configuration mode 1 (bios)
> pchb0 at pci0 dev 1 function 0 "AMD Geode LX" rev 0x33
> glxsb0 at pci0 dev 1 function 2 "AMD Geode LX Crypto" rev 0x00: RNG AES
> vr0 at pci0 dev 9 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 10, address
> 00:0d:b9:1e:85:8c
> ukphy0 at vr0 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
> 0x004063, model 0x0034
> vr1 at pci0 dev 10 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 11,
> address 00:0d:b9:1e:85:8d
> ukphy1 at vr1 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
> 0x004063, model 0x0034
> vr2 at pci0 dev 11 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 15,
> address 00:0d:b9:1e:85:8e
> ukphy2 at vr2 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
> 0x004063, model 0x0034
> glxpcib0 at pci0 dev 15 function 0 "AMD CS5536 ISA" rev 0x03: rev 3, 32-bit
> 3579545Hz timer, watchdog, gpio, i2c
> gpio0 at glxpcib0: 32 pins
> iic0 at glxpcib0
> maxtmp0 at iic0 addr 0x4c: lm86
> pciide0 at pci0 dev 15 function 2 "AMD CS5536 IDE" rev 0x01: DMA, channel 0
> wired to compatibility, channel 1 wired to compatibility
> wd0 at pciide0 channel 0 drive 0: <SanDisk SDCFH-008G>
> wd0: 1-sector PIO, LBA48, 7629MB, 15625216 sectors
> wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 2
> pciide0: channel 1 ignored (disabled)
> ohci0 at pci0 dev 15 function 4 "AMD CS5536 USB" rev 0x02: irq 12, version
> 1.0, legacy support
> ehci0 at pci0 dev 15 function 5 "AMD CS5536 USB" rev 0x02: irq 12
> usb0 at ehci0: USB revision 2.0
> uhub0 at usb0 configuration 1 interface 0 "AMD EHCI root hub" rev 2.00/1.00
> addr 1
> isa0 at glxpcib0
> isadma0 at isa0
> com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
> com0: console
> com1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
> pcppi0 at isa0 port 0x61
> spkr0 at pcppi0
> npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
> usb1 at ohci0: USB revision 1.0
> uhub1 at usb1 configuration 1 interface 0 "AMD OHCI root hub" rev 1.00/1.00
> addr 1
> nvram: invalid checksum
> vscsi0 at root
> scsibus1 at vscsi0: 256 targets
> softraid0 at root
> scsibus2 at softraid0: 256 targets
> root on wd0a (83b335c3c86bb80c.a) swap on wd0b dump on wd0b
> clock: unknown CMOS layout
>
> On Mon, 19 Aug 2019 18:17:48 -0500
> Patrick Dohman <dohmanpatr...@gmail.com> wrote:
>
>> Do you consider memory an issue?
>> What is the speed of your memory?
>> Unix load average can occasionally be deceiving.
>> What make of Ethernets are you running?
>> Regards
>> Patrick
>>
>>> On Aug 19, 2019, at 5:28 AM, radek <r...@int.pl> wrote:
>>>
>>> Hello Patrick,
>>>
>>>> Does your ISP implement authoritative DNS?
>>>> Do you suspect a UDP issue?
>>> My VPN is configured with IPs, not with domain names. Does DNS and/or UDP
>>> matter anyway?
>>>
>>>> Is a managed (switch) involved?
>>> No, it is not. I do not use any switches in my testing setup.
>>> GW1--ISP1_modem--.....--ISP2_modem--GW2
>>>
>>> Has duplex ever been an issue?
>>> I have never noticed any duplex issue.
>>>
>>>
>>> On Sun, 18 Aug 2019 16:07:14 -0500
>>> Patrick Dohman <dohmanpatr...@gmail.com> wrote:
>>>
>>>> Does your ISP implement authoritative DNS?
>>>> Do you suspect a UDP issue?
>>>> Is a managed (switch) involved? Has duplex ever been an issue?
>>>> Regards
>>>> Patrick
>>>>
>>>>> On Aug 18, 2019, at 1:03 PM, Radek <r...@int.pl> wrote:
>>>>>
>>>>> Hello,
>>>>>
>>>>> I have two testing gateways (6.5/i386) with site-to-side VPN between its
>>>>> LANs (OpenIKED).
>>>>> Both gws are fully syspatched, have public IPs and the same iked/pf
>>>>> configuration.
>>>>>
>>>>> Unfortunately, the network traffic over the VPN tunnel stalls few times a
>>>>> day.
>>>>>
>>>>> On the one side I use a script to monitor VPN tunnel with ping, it
>>>>> restarts iked and emails me if there is no ping over the VPN tunnel.
>>>>> Date: Sat, 17 Aug 2019 22:10:30 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 06:00:20 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 11:09:00 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 19:03:02 +0200 (CEST)
>>>>>
>>>>>
>>>>> In 6.3/i386 I have the same problem, but more frequently.
>>>>> Date: Sat, 17 Aug 2019 23:03:56 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 01:37:50 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 04:12:31 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 06:46:25 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 09:20:22 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 11:59:08 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 14:34:38 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 17:12:57 +0200 (CEST)
>>>>> Date: Sun, 18 Aug 2019 19:47:16 +0200 (CEST)
>>>>>
>>>>> Do I have any bugs/deficiencies in my configs, missed something?
>>>>> Is there any way to make it work uninterruptedly?
>>>>> I would be very greatful if you could help me with this case.
>>>>>
>>>>> $cat /etc/hostname.enc0
>>>>> up
>>>>>
>>>>> $cat /etc/hostname.vr3
>>>>> inet 10.0.17.254 255.255.255.0 NONE description "LAN17"
>>>>> group trust
>>>>>
>>>>> $cat /etc/iked.conf
>>>>> local_gw_RAC17 = "10.0.17.254" # lan_RAC
>>>>> local_lan_RAC17 = "10.0.17.0/24"
>>>>> remote_gw_MON = "1.2.3.5" # fw_MON
>>>>> remote_lan_MON = "172.16.1.0/24"
>>>>> ikev2 quick active esp \
>>>>> from $local_gw_RAC17 to $remote_gw_MON \
>>>>> from $local_lan_RAC17 to $remote_lan_MON peer $remote_gw_MON \
>>>>> childsa enc chacha20-poly1305 \
>>>>> psk "psk"
>>>>>
>>>>> $cat /etc/pf.conf
>>>>> # RAC-fwTEST
>>>>> ext_if = "vr0"
>>>>> lan_rac_if = "vr3" # vr3 -
>>>>> lan_rac_local = $lan_rac_if:network # 10.0.17.0/24
>>>>> backup_if = "vr2" # vr2 - lewy port
>>>>> backup_local = $backup_if:network # 10.0.117/24
>>>>>
>>>>> bud = "1.2.3.0/25"
>>>>> rdk_wy = "1.2.3.4"
>>>>> rdk_mon = "1.2.3.5"
>>>>> panac_krz = "1.2.3.6"
>>>>> panac_rac = "1.2.3.7"
>>>>>
>>>>> set fingerprints "/dev/null"
>>>>> set skip on { lo, enc0 }
>>>>> set block-policy drop
>>>>> set optimization normal
>>>>> set ruleset-optimization basic
>>>>>
>>>>> antispoof quick for {lo0, $lan_rac_if, $backup_if }
>>>>>
>>>>> match out log on $ext_if from { $lan_rac_local, $backup_local } nat-to
>>>>> $ext_if set prio (3, 7)
>>>>>
>>>>> block all
>>>>>
>>>>> match in all scrub (no-df random-id)
>>>>> match out all scrub (no-df random-id)
>>>>> pass out on egress keep state
>>>>>
>>>>> pass from { 10.0.201.0/24, $lan_rac_local, $backup_local } to any set
>>>>> prio (3, 7) keep state
>>>>>
>>>>> ssh_port = "1071"
>>>>> table <ssh_trust> const { $bud, $rdk_wy, $rdk_mon, $panac_krz,
>>>>> $panac_rac, 10.0.2.0/24, 10.0.15.0/24, 10.0.100.0/24 }
>>>>> table <bruteforce> persist counters
>>>>> block from <bruteforce>
>>>>> pass in log quick inet proto tcp from <ssh_trust> to $ext_if port
>>>>> $ssh_port flags S/SA \
>>>>> set prio (7, 7) keep state \
>>>>> (max-src-conn 15, max-src-conn-rate 2/10, overload <bruteforce> flush
>>>>> global)
>>>>>
>>>>> icmp_types = "{ echoreq, unreach }"
>>>>> pass inet proto icmp all icmp-type $icmp_types \
>>>>> set prio (7, 7) keep state
>>>>>
>>>>> table <vpn_peers> const { $rdk_mon, $panac_rac, $panac_krz }
>>>>> pass out quick on egress proto esp from (egress:0) to <vpn_peers>
>>>>> set prio (6, 7) keep state
>>>>> pass out quick on egress proto udp from (egress:0) to <vpn_peers> port
>>>>> {500, 4500} set prio (6, 7) keep state
>>>>> pass in quick on egress proto esp from <vpn_peers> to (egress:0)
>>>>> set prio (6, 7) keep state
>>>>> pass in quick on egress proto udp from <vpn_peers> to (egress:0) port
>>>>> {500, 4500} set prio (6, 7) keep state
>>>>> pass out quick on trust received-on enc0 set prio (6, 7) keep state
>>>>>
>>>>> pass in on egress proto udp from any to (egress:0) port
>>>>> {isakmp,ipsec-nat-t} set prio (6,7) keep state
>>>>> pass in on egress proto {ah,esp} set prio (6,7) keep state
>>>>>
>>>>> # By default, do not permit remote connections to X11
>>>>> block return in on ! lo0 proto tcp to port 6000:6010
>>>>>
>>>>> $cat iked_monitor.sh
>>>>> #!/bin/sh
>>>>> while true
>>>>> do
>>>>> vpn=`ping -c 3 -w 1 -I 10.0.17.254 172.16.1.254 | grep packets | awk -F "
>>>>> " '{print $4}'`
>>>>>
>>>>> if [ "${vpn}" -eq 0 ] ; then
>>>>> mon=`ping -c 3 -w 1 the_other_side_WAN_IP | grep packets | awk -F " "
>>>>> '{print $4}'`
>>>>> wan=`ping -c 3 -w 1 8.8.8.8 | grep packets | awk -F " " '{print $4}'`
>>>>>
>>>>> if [ "${mon}" -gt 0 ] && [ "${wan}" -gt 0 ] ; then
>>>>> echo vpn: ${vpn}, mon: ${mon}, wan: ${wan} | mail -s "no ping through
>>>>> VPN RACTEST-MON! restartng iked!" em...@example.com
>>>>> rcctl restart iked
>>>>> fi
>>>>> fi
>>>>> sleep 32
>>>>> done
>>>>>
>>>>>
>>>>> --
>>>>> Radek
>>>>>
>>>>
>>>
>>>
>>> --
>>> Radek
>>>
>>
>
>
> --
> Radek
>
