News for hackers. Stuff that matters.

A comment on pfSense: Open source network firewall distribution. Parent comment

Re:pfSense: Open source network firewall distribution by ComputerGuru on Friday February 10, 2017 @10:57AM (#13616219)
Yeah, you have to disable tcp hardware packet segmentation offloading.
[ Parent | on HN ]
Re:pfSense: Open source network firewall distribution by chrisper on Friday February 10, 2017 @11:38AM (#13616653)
Do you know if I have to do that with regular FreeBSD as well? Like if I were to run just FreeBSD and not pfSense.
[ Parent | on HN ]
Re:pfSense: Open source network firewall distribution by gonzo on Friday February 10, 2017 @03:28PM (#13618600)
The answer here is 'Yes'. TSO and routing / packet filtering are incompatible.

https://wiki.freebsd.org/10gFreeBSD/Router#Disabling_LRO_and...

[ Parent | on HN ]
Re:pfSense: Open source network firewall distribution by ComputerGuru on Saturday February 11, 2017 @10:00AM (#13622867)
So why isn't it disabled out of the box (on pfSense, not FreeBSD)?
[ Parent | on HN ]
Re:pfSense: Open source network firewall distribution by gonzo on Saturday February 11, 2017 @05:17PM (#13625169)
They are.

https://doc.pfsense.org/index.php/Tuning_and_Troubleshooting...

[ Parent | on HN ]
Re:pfSense: Open source network firewall distribution by ComputerGuru on Saturday February 11, 2017 @09:38PM (#13626328)
Do you know when this was instituted? I'm quite sure that wasn't the default when I set up my pfSense systems..
[ Parent | on HN ]
Re:pfSense: Open source network firewall distribution by ComputerGuru on Friday February 10, 2017 @12:21PM (#13617046)
I don't on my FreeBSD hosts and haven't had any problems, but I think it depends on the drivers you have installed. On all my production servers I use standalone Intel NICs w/ the Intel drives; pfSense may be using something else depending on the configuration. FWIW, pfSense has been basically stock FreeBSD + software/skin for the past couple of years.
[ Parent | on HN ]
Re:pfSense: Open source network firewall distribution by gonzo on Friday February 10, 2017 @05:16PM (#13619391)
> FWIW, pfSense has been basically stock FreeBSD + software/skin for the past couple of years.

While we try to move things upstream as much as possible, there are still patches in pfSense that don't make sense for FreeBSD.

> I don't on my FreeBSD hosts and haven't had any problems

TSO and routing/forwarding (and thus filtering) are incompatible.

[ Parent | on HN ]
Re:pfSense: Open source network firewall distribution by wila on Friday February 10, 2017 @05:00PM (#13619288)
yep, use Intel e1000e NICs for freeBSD on VMware hosts.
[ Parent | on HN ]
Re:pfSense: Open source network firewall distribution by krylon on Friday February 10, 2017 @01:16PM (#13617537)
FWIW, I have seen that advice given for problems with networking performance in virtualized environments, regardless of the operating system.
[ Parent | on HN ]