Bug with netfilter and NFS server on same machine

Bug with netfilter and NFS server on same machine

[Lars Knudsen]

I have been experiencing problems running a nfs server and iptables on 
the same machine.The problem was also reported almost a year ago by Paul 
Raines 
http://lists.netfilter.org/pipermail/netfilter/2002-January/030002.html 
but it seems no solution has been found yet.

The problem is this: A machine running linux 2.4.18 or 2.4.19 works just 
fine when running just the kernel nfsd. A single client connected to the 
server with 100Mbit ethernet sees throughput of 5-10MByte/sec even after 
an hour or two of continous transfers. If the nfs server is also running 
iptables the throughput is initially the same (5-10MByte/sec) but after 
a while (200MByte-500MByte total transfer) the client starts reporting 
"nfs server not responding" followed after a while by "nfs server OK" 
and of course the transfer rate goes way down (< 1MByte/sec). Using 
tcpdump on the client seems to indicate that some packets have their 
headers garbled - wrong fragment ids being the typical error.

Having iptables compiled as modules and simply loading or unloading the 
ipt_conntrack module is
sufficient for causing/removing the problem. Having iptables support 
compiled into the kernel causes the problem allways.

The problem has been verified on 4 different machines with a variety of 
different ethernet cards. In
all cases the network continues to work without problems for all other 
types of traffic - i.e a telnet connection from client to server works 
with no delay and a ftp transfer goes at >5MByte/sec even when nfs 
throughput is suffering.

\Lars Knudsen

Re: Bug with netfilter and NFS server on same machine

[Luciano Ruete]

Lars Knudsen escribió::
> I have been experiencing problems running a nfs server and iptables on 
> (...)
> The problem has been verified on 4 different machines with a variety of 
> different ethernet cards. In
> all cases the network continues to work without problems for all other 
> types of traffic - i.e a telnet connection from client to server works 
> with no delay and a ftp transfer goes at >5MByte/sec even when nfs 
> throughput is suffering.

I sugest that you send this to linux-kernel@vger.kernel.org

--
Luciano

Bug with netfilter and NFS server on same machine

[Lars Knudsen]

I have been experiencing problems running a nfs server and iptables on 
the same machine.The problem was also reported almost a year ago by Paul 
Raines on the netfilter mailing list 
http://lists.netfilter.org/pipermail/netfilter/2002-January/030002.html 
but it seems no solution has been found yet.

The problem is this: A machine running linux 2.4.18 or 2.4.19 works just 
fine when running just the kernel nfsd. A single client connected to the 
server with 100Mbit ethernet sees throughput of 5-10MByte/sec even after 
an hour or two of continous transfers. If the nfs server is also running 
iptables the throughput is initially the same (5-10MByte/sec) but after 
a while (200MByte-500MByte total transfer) the client starts reporting 
"nfs server not responding" followed after a while by "nfs server OK" 
and of course the transfer rate goes way down (< 1MByte/sec). Using 
tcpdump on the client seems to indicate that some packets have their 
headers garbled - wrong fragment ids being the typical error.

Having iptables compiled as modules and simply loading or unloading the 
ipt_conntrack module is
sufficient for causing/removing the problem. Having iptables support 
compiled into the kernel causes the problem allways.

The problem has been verified on 4 different machines with a variety of 
different ethernet cards. In
all cases the network continues to work without problems for all other 
types of traffic - i.e a telnet connection from client to server works 
with no delay and a ftp transfer goes at >5MByte/sec even when nfs 
throughput is suffering.

\Lars Knudsen

Re: Bug with netfilter and NFS server on same machine

[Daniel Egger]

[-- Attachment #1: Type: text/plain, Size: 2714 bytes --]

Am Sam, 2002-11-23 um 19.37 schrieb Lars Knudsen:

> The problem is this: A machine running linux 2.4.18 or 2.4.19 works just 
> fine when running just the kernel nfsd. A single client connected to the 
> server with 100Mbit ethernet sees throughput of 5-10MByte/sec even after 
> an hour or two of continous transfers. If the nfs server is also running 
> iptables the throughput is initially the same (5-10MByte/sec) but after 
> a while (200MByte-500MByte total transfer) the client starts reporting 
> "nfs server not responding" followed after a while by "nfs server OK" 
> and of course the transfer rate goes way down (< 1MByte/sec). Using 
> tcpdump on the client seems to indicate that some packets have their 
> headers garbled - wrong fragment ids being the typical error.

Linux nicole 2.4.19-586tsc #1 Sun Oct 6 18:00:21 EST 2002 i586 unknown unknown GNU/Linux

egger@nicole:~$ sudo lsmod
Module                  Size  Used by    Not tainted
ipt_TOS                 1016  12  (autoclean)
ipt_MASQUERADE          1176   1  (autoclean)
ipt_REDIRECT             728   1  (autoclean)
ipt_REJECT              2776   4  (autoclean)
ipt_LOG                 3160   6  (autoclean)
ipt_state                568  55  (autoclean)
iptable_mangle          2100   1  (autoclean)
ip_nat_irc              2288   0  (unused)
ip_nat_ftp              2960   0  (unused)
iptable_nat            13208   3  [ipt_MASQUERADE ipt_REDIRECT ip_nat_irc ip_nat_ftp]
ip_conntrack_irc        2464   0  (unused)
ip_conntrack_ftp        3200   0  (unused)
ip_conntrack           13148   4  [ipt_MASQUERADE ipt_REDIRECT ipt_state ip_nat_irc ip_nat_ftp iptable_nat ip_conntrack_irc ip_conntrack_ftp]
iptable_filter          1672   1  (autoclean)
ip_tables              10488  11  [ipt_TOS ipt_MASQUERADE ipt_REDIRECT ipt_REJECT ipt_LOG ipt_state iptable_mangle iptable_nat iptable_filter]
nfsd                   65616   5  (autoclean)
lockd                  46864   1  (autoclean) [nfsd]
sunrpc                 57436   1  (autoclean) [nfsd lockd]
af_packet              11656   1  (autoclean)

00:12.0 Ethernet controller: D-Link System Inc Sundance Ethernet
        Subsystem: D-Link System Inc Sundance Ethernet
        Flags: bus master, medium devsel, latency 64, IRQ 5
        I/O ports at d800 [size=128]
        Memory at e2810000 (32-bit, non-prefetchable) [size=128]
        Expansion ROM at e1000000 [disabled] [size=64K]
        Capabilities: <available only to root>

No problems with NFS whatsoever. Gigabytes of traffic get from or to
this machine without any lag. The firewall is rather restricted to the
inside and NFS nailed to fixed ports.

-- 
Servus,
       Daniel

[-- Attachment #2: Dies ist ein digital signierter Nachrichtenteil --]
[-- Type: application/pgp-signature, Size: 189 bytes --]