* Re: AW: bandwidth problems [Linux 2.4.20] [iptables 1.2.7a] [not found] <200402101943.i1AJhR9M012184@nmibwkms1.nexusmgmt.com> @ 2004-02-10 19:49 ` John A. Sullivan III 2004-02-11 10:31 ` AW: " root 0 siblings, 1 reply; 6+ messages in thread From: John A. Sullivan III @ 2004-02-10 19:49 UTC (permalink / raw) To: XXmas; +Cc: netfilter On Tue, 2004-02-10 at 14:43, root@scheuchenstuel.com wrote: > > > Hi! > > > > > > My configuration: > > > ================= > > > > > > O-------------o O-----------------------o > > > | WinXP | | eth0 | eth1 | > > > | 10.10.1.100 |----| 10.10.1.254 | D H C P |----INTERNET > > > | | | | | > > > O-------------o O-----------------------o > > > My Computer My NAT-Computer > > > > > > NAT-Computer: > > > Linux 2.4.20-4GB > > > load average: 0.08, 0.05, 0.06 > > > iptables v1.2.7a > > > All the NICs I use are 3com 3C905-TX > > > > > > When I do some bandwidth tests on the NAT-Computer > > (provider's service > > > page) my bandwidth is about 1MBit/second When I do the same on my > > > computer I only get about 100kbit/second > > > > > > Now I wonder if there are any problems with my configuration...? > > > Would be nice if you could help me... > > > > > > Thanks in advance > > > Florian St. > > > > > > Root(AT)scheuchenstuel(DOT)com > > > > > > > > > My iptables-configuration: > > > ========================== > > > > > > > > ###################################################################### > > > ###### > > > ###### > > > > > > #!/bin/bash > > > # > > > > > > modprobe iptable_nat > > > echo 1 > /proc/sys/net/ipv4/ip_forward > > > > > > ########## CLEARING TABLES > > > iptables -F > > > iptables -t nat -F > > > iptables -t mangle -F > > > iptables -X > > > > > > ########## SETTING POLICIES > > > iptables -P INPUT DROP > > > iptables -P OUTPUT ACCEPT > > > iptables -P FORWARD DROP > > > > > > ########## NAT > > > iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j > > > ACCEPT iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE > > > > > > ########## LOOPBACK SETTINGS > > > iptables -A INPUT -i lo -j ACCEPT > > > iptables -A INPUT -s 127.0.0.1/32 -j ACCEPT > > > > > > ########## EXTERNAL OPEN PORTS > > > iptables -A INPUT -i eth1 -p tcp --dport 80 -j ACCEPT > > > > > > ########## INTERNAL OPEN PORTS > > > iptables -A INPUT -s 10.10.1.100/32 -j ACCEPT > > > > > > ######### NAT FORWARDING > > > iptables -A FORWARD -s 10.10.1.100/32 -j ACCEPT iptables -A > > FORWARD -d > > > 10.10.1.100/32 -j ACCEPT > > > > > > > > ###################################################################### > > > ###### > > > ###### > > > > The rules look a little unusual; in fact, they look downright > > dangerous. You may want to read a good iptables tutorial > > such as the one by Oskar Andreasson. You can find a link to > > it on the netfilter.org web site. You can also find some > > slide shows in the training section at http://iscs.sourceforge.net > > > > However, I do not think your rules would create a throughput problem. > > How are you measuring your throughput? > > -- > > John A. Sullivan III > > Chief Technology Officer > > Nexus Management > > +1 207-985-7880 > > john.sullivan@nexusmgmt.com > > --- > > If you are interested in helping to develop a GPL enterprise > > class VPN/Firewall/Security device management console, please > > visit http://iscs.sourceforge.net > > > > Now i tried to use a script sufggested by Oskar Andreasson > http://iptables-tutorial.frozentux.net/iptables-tutorial.html#RCFIREWALLTXT > > But the problem is still the same... > I think there is another problem... > > When i configure&start squid on the NAT-Computer i have full bandwidth... > > I don't know what to do anymore... > > Thanks in advance > Florian St. How are you measuring your throughput? What happens if you don't use squid but allow direct (iptables protected) web access from the client? -- John A. Sullivan III Chief Technology Officer Nexus Management +1 207-985-7880 john.sullivan@nexusmgmt.com --- If you are interested in helping to develop a GPL enterprise class VPN/Firewall/Security device management console, please visit http://iscs.sourceforge.net ^ permalink raw reply [flat|nested] 6+ messages in thread
* AW: AW: bandwidth problems [Linux 2.4.20] [iptables 1.2.7a] 2004-02-10 19:49 ` AW: bandwidth problems [Linux 2.4.20] [iptables 1.2.7a] John A. Sullivan III @ 2004-02-11 10:31 ` root 2004-02-11 15:52 ` John A. Sullivan III 0 siblings, 1 reply; 6+ messages in thread From: root @ 2004-02-11 10:31 UTC (permalink / raw) To: 'John A. Sullivan III'; +Cc: netfilter > > > > Hi! > > > > > > > > My configuration: > > > > ================= > > > > > > > > O-------------o O-----------------------o > > > > | WinXP | | eth0 | eth1 | > > > > | 10.10.1.100 |----| 10.10.1.254 | D H C P |----INTERNET > > > > | | | | | > > > > O-------------o O-----------------------o > > > > My Computer My NAT-Computer > > > > > > > > NAT-Computer: > > > > Linux 2.4.20-4GB > > > > load average: 0.08, 0.05, 0.06 > > > > iptables v1.2.7a > > > > All the NICs I use are 3com 3C905-TX > > > > > > > > When I do some bandwidth tests on the NAT-Computer > > > (provider's service > > > > page) my bandwidth is about 1MBit/second When I do the > same on my > > > > computer I only get about 100kbit/second > > > > > > > > Now I wonder if there are any problems with my configuration...? > > > > Would be nice if you could help me... > > > > > > > > Thanks in advance > > > > Florian St. > > > > > > > > Root(AT)scheuchenstuel(DOT)com > > > > > > > > > > > > My iptables-configuration: > > > > ========================== > > > > > > > > > > > > #################################################################### > > > ## > > > > ###### > > > > ###### > > > > > > > > #!/bin/bash > > > > # > > > > > > > > modprobe iptable_nat > > > > echo 1 > /proc/sys/net/ipv4/ip_forward > > > > > > > > ########## CLEARING TABLES > > > > iptables -F > > > > iptables -t nat -F > > > > iptables -t mangle -F > > > > iptables -X > > > > > > > > ########## SETTING POLICIES > > > > iptables -P INPUT DROP > > > > iptables -P OUTPUT ACCEPT > > > > iptables -P FORWARD DROP > > > > > > > > ########## NAT > > > > iptables -A INPUT -i eth1 -m state --state > ESTABLISHED,RELATED -j > > > > ACCEPT iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE > > > > > > > > ########## LOOPBACK SETTINGS > > > > iptables -A INPUT -i lo -j ACCEPT > > > > iptables -A INPUT -s 127.0.0.1/32 -j ACCEPT > > > > > > > > ########## EXTERNAL OPEN PORTS > > > > iptables -A INPUT -i eth1 -p tcp --dport 80 -j ACCEPT > > > > > > > > ########## INTERNAL OPEN PORTS > > > > iptables -A INPUT -s 10.10.1.100/32 -j ACCEPT > > > > > > > > ######### NAT FORWARDING > > > > iptables -A FORWARD -s 10.10.1.100/32 -j ACCEPT iptables -A > > > FORWARD -d > > > > 10.10.1.100/32 -j ACCEPT > > > > > > > > > > > > #################################################################### > > > ## > > > > ###### > > > > ###### > > > > > > The rules look a little unusual; in fact, they look downright > > > dangerous. You may want to read a good iptables tutorial such as > > > the one by Oskar Andreasson. You can find a link to it on the > > > netfilter.org web site. You can also find some slide > shows in the > > > training section at http://iscs.sourceforge.net > > > > > > However, I do not think your rules would create a > throughput problem. > > > How are you measuring your throughput? > > > -- > > > John A. Sullivan III > > > Chief Technology Officer > > > Nexus Management > > > +1 207-985-7880 > > > john.sullivan@nexusmgmt.com > > > --- > > > > Now i tried to use a script suggested by Oskar Andreasson > > > http://iptables-tutorial.frozentux.net/iptables-tutorial.html#RCFIREWA > > LLTXT > > > > But the problem is still the same... > > I think there is another problem... > > > > When i configure&start squid on the NAT-Computer i have > full bandwidth... > > > > I don't know what to do anymore... > > > > Thanks in advance > > Florian St. > How are you measuring your throughput? What happens if you > don't use squid but allow direct (iptables protected) web > access from the client? > -- > John A. Sullivan III > Chief Technology Officer > Nexus Management > +1 207-985-7880 > john.sullivan@nexusmgmt.com > --- I use the bandwidth test-page of my provider... http://performance.chello.at:81 What do you mean with "direct" web access ? Web access via NAT ? I have entered the NAT-computer's IP as default gateway and the provider's DNS-servers as DNS-servers on my PC. I think this is what you mean with direct access... With this direct access i only get about 100kbit, when i use squid or when i do the tests on the NAT-computer i have full Bandwidth (around 1MBit/sec) I think there is a general problem with my configuration, because the bandwidth is no better with iptables-scripts which are known to work fine... I really don't know what to do anymore... Thanks in advance Florian St. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: AW: AW: bandwidth problems [Linux 2.4.20] [iptables 1.2.7a] 2004-02-11 10:31 ` AW: " root @ 2004-02-11 15:52 ` John A. Sullivan III 2004-02-12 7:16 ` AW: " root 0 siblings, 1 reply; 6+ messages in thread From: John A. Sullivan III @ 2004-02-11 15:52 UTC (permalink / raw) To: root; +Cc: netfilter On Wed, 2004-02-11 at 05:31, root@scheuchenstuel.com wrote: > > > > > Hi! > > > > > > > > > > My configuration: > > > > > ================= > > > > > > > > > > O-------------o O-----------------------o > > > > > | WinXP | | eth0 | eth1 | > > > > > | 10.10.1.100 |----| 10.10.1.254 | D H C P |----INTERNET > > > > > | | | | | > > > > > O-------------o O-----------------------o > > > > > My Computer My NAT-Computer > > > > > > > > > > NAT-Computer: > > > > > Linux 2.4.20-4GB > > > > > load average: 0.08, 0.05, 0.06 > > > > > iptables v1.2.7a > > > > > All the NICs I use are 3com 3C905-TX > > > > > > > > > > When I do some bandwidth tests on the NAT-Computer > > > > (provider's service > > > > > page) my bandwidth is about 1MBit/second When I do the > > same on my > > > > > computer I only get about 100kbit/second > > > > > > > > > > Now I wonder if there are any problems with my configuration...? > > > > > Would be nice if you could help me... > > > > > > > > > > Thanks in advance > > > > > Florian St. > > > > > > > > > > Root(AT)scheuchenstuel(DOT)com > > > > > > > > > > > > > > > My iptables-configuration: > > > > > ========================== > > > > > > > > > > > > > > > > #################################################################### > > > > ## > > > > > ###### > > > > > ###### > > > > > > > > > > #!/bin/bash > > > > > # > > > > > > > > > > modprobe iptable_nat > > > > > echo 1 > /proc/sys/net/ipv4/ip_forward > > > > > > > > > > ########## CLEARING TABLES > > > > > iptables -F > > > > > iptables -t nat -F > > > > > iptables -t mangle -F > > > > > iptables -X > > > > > > > > > > ########## SETTING POLICIES > > > > > iptables -P INPUT DROP > > > > > iptables -P OUTPUT ACCEPT > > > > > iptables -P FORWARD DROP > > > > > > > > > > ########## NAT > > > > > iptables -A INPUT -i eth1 -m state --state > > ESTABLISHED,RELATED -j > > > > > ACCEPT iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE > > > > > > > > > > ########## LOOPBACK SETTINGS > > > > > iptables -A INPUT -i lo -j ACCEPT > > > > > iptables -A INPUT -s 127.0.0.1/32 -j ACCEPT > > > > > > > > > > ########## EXTERNAL OPEN PORTS > > > > > iptables -A INPUT -i eth1 -p tcp --dport 80 -j ACCEPT > > > > > > > > > > ########## INTERNAL OPEN PORTS > > > > > iptables -A INPUT -s 10.10.1.100/32 -j ACCEPT > > > > > > > > > > ######### NAT FORWARDING > > > > > iptables -A FORWARD -s 10.10.1.100/32 -j ACCEPT iptables -A > > > > FORWARD -d > > > > > 10.10.1.100/32 -j ACCEPT > > > > > > > > > > > > > > > > #################################################################### > > > > ## > > > > > ###### > > > > > ###### > > > > > > > > The rules look a little unusual; in fact, they look downright > > > > dangerous. You may want to read a good iptables tutorial such as > > > > the one by Oskar Andreasson. You can find a link to it on the > > > > netfilter.org web site. You can also find some slide > > shows in the > > > > training section at http://iscs.sourceforge.net > > > > > > > > However, I do not think your rules would create a > > throughput problem. > > > > How are you measuring your throughput? > > > > -- > > > > John A. Sullivan III > > > > Chief Technology Officer > > > > Nexus Management > > > > +1 207-985-7880 > > > > john.sullivan@nexusmgmt.com > > > > --- > > > > > > Now i tried to use a script suggested by Oskar Andreasson > > > > > http://iptables-tutorial.frozentux.net/iptables-tutorial.html#RCFIREWA > > > LLTXT > > > > > > But the problem is still the same... > > > I think there is another problem... > > > > > > When i configure&start squid on the NAT-Computer i have > > full bandwidth... > > > > > > I don't know what to do anymore... > > > > > > Thanks in advance > > > Florian St. > > How are you measuring your throughput? What happens if you > > don't use squid but allow direct (iptables protected) web > > access from the client? > > -- > > John A. Sullivan III > > Chief Technology Officer > > Nexus Management > > +1 207-985-7880 > > john.sullivan@nexusmgmt.com > > --- > > I use the bandwidth test-page of my provider... > http://performance.chello.at:81 > > What do you mean with "direct" web access ? > Web access via NAT ? > I have entered the NAT-computer's IP as default gateway > and the provider's DNS-servers as DNS-servers on my PC. > I think this is what you mean with direct access... > > With this direct access i only get about 100kbit, when i use > squid or when i do the tests on the NAT-computer i have full > Bandwidth (around 1MBit/sec) > > I think there is a general problem with my configuration, > because the bandwidth is no better with iptables-scripts > which are known to work fine... > > I really don't know what to do anymore... > > Thanks in advance > Florian St. As I look at it, unless you have significantly altered your scripts, you are probably not using Squid. I see no rule to redirect your web traffic to Squid. What happens if you disable Squid? -- John A. Sullivan III Chief Technology Officer Nexus Management +1 207-985-7880 john.sullivan@nexusmgmt.com ^ permalink raw reply [flat|nested] 6+ messages in thread
* AW: AW: AW: bandwidth problems [Linux 2.4.20] [iptables 1.2.7a] 2004-02-11 15:52 ` John A. Sullivan III @ 2004-02-12 7:16 ` root 2004-02-12 12:04 ` John A. Sullivan III 0 siblings, 1 reply; 6+ messages in thread From: root @ 2004-02-12 7:16 UTC (permalink / raw) To: 'John A. Sullivan III'; +Cc: netfilter > > > > > > Hi! > > > > > > > > > > > > My configuration: > > > > > > ================= > > > > > > > > > > > > O-------------o O-----------------------o > > > > > > | WinXP | | eth0 | eth1 | > > > > > > | 10.10.1.100 |----| 10.10.1.254 | D H C P |----INTERNET > > > > > > | | | | | > > > > > > O-------------o O-----------------------o > > > > > > My Computer My NAT-Computer > > > > > > > > > > > > NAT-Computer: > > > > > > Linux 2.4.20-4GB > > > > > > load average: 0.08, 0.05, 0.06 > > > > > > iptables v1.2.7a > > > > > > All the NICs I use are 3com 3C905-TX > > > > > > > > > > > > When I do some bandwidth tests on the NAT-Computer > > > > > (provider's service > > > > > > page) my bandwidth is about 1MBit/second When I do the > > > same on my > > > > > > computer I only get about 100kbit/second > > > > > > > > > > > > Now I wonder if there are any problems with my > configuration...? > > > > > > Would be nice if you could help me... > > > > > > > > > > > > Thanks in advance > > > > > > Florian St. > > > > > > > > > > > > Root(AT)scheuchenstuel(DOT)com > > > > > > > > > > > > > > > > > > My iptables-configuration: > > > > > > ========================== > > > > > > > > > > > > > > > > > > > > > #################################################################### > > > > > ## > > > > > > ###### > > > > > > ###### > > > > > > > > > > > > #!/bin/bash > > > > > > # > > > > > > > > > > > > modprobe iptable_nat > > > > > > echo 1 > /proc/sys/net/ipv4/ip_forward > > > > > > > > > > > > ########## CLEARING TABLES > > > > > > iptables -F > > > > > > iptables -t nat -F > > > > > > iptables -t mangle -F > > > > > > iptables -X > > > > > > > > > > > > ########## SETTING POLICIES > > > > > > iptables -P INPUT DROP > > > > > > iptables -P OUTPUT ACCEPT > > > > > > iptables -P FORWARD DROP > > > > > > > > > > > > ########## NAT > > > > > > iptables -A INPUT -i eth1 -m state --state > > > ESTABLISHED,RELATED -j > > > > > > ACCEPT iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE > > > > > > > > > > > > ########## LOOPBACK SETTINGS > > > > > > iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -s > > > > > > 127.0.0.1/32 -j ACCEPT > > > > > > > > > > > > ########## EXTERNAL OPEN PORTS iptables -A INPUT -i eth1 -p > > > > > > tcp --dport 80 -j ACCEPT > > > > > > > > > > > > ########## INTERNAL OPEN PORTS iptables -A INPUT -s > > > > > > 10.10.1.100/32 -j ACCEPT > > > > > > > > > > > > ######### NAT FORWARDING > > > > > > iptables -A FORWARD -s 10.10.1.100/32 -j ACCEPT iptables -A > > > > > FORWARD -d > > > > > > 10.10.1.100/32 -j ACCEPT > > > > > > > > > > > > > > > > > > > > > #################################################################### > > > > > ## > > > > > > ###### > > > > > > ###### > > > > > > > > > > The rules look a little unusual; in fact, they look downright > > > > > dangerous. You may want to read a good iptables > tutorial such > > > > > as the one by Oskar Andreasson. You can find a link to it on > > > > > the netfilter.org web site. You can also find some slide > > > shows in the > > > > > training section at http://iscs.sourceforge.net > > > > > > > > > > However, I do not think your rules would create a > > > throughput problem. > > > > > How are you measuring your throughput? > > > > > -- > > > > > John A. Sullivan III > > > > > Chief Technology Officer > > > > > Nexus Management > > > > > +1 207-985-7880 > > > > > john.sullivan@nexusmgmt.com > > > > > --- > > > > > > > > Now i tried to use a script suggested by Oskar Andreasson > > > > > > > > http://iptables-tutorial.frozentux.net/iptables-tutorial.html#RCFIRE > > > WA > > > > LLTXT > > > > > > > > But the problem is still the same... > > > > I think there is another problem... > > > > > > > > When i configure&start squid on the NAT-Computer i have > > > full bandwidth... > > > > > > > > I don't know what to do anymore... > > > > > > > > Thanks in advance > > > > Florian St. > > > How are you measuring your throughput? What happens if > you don't use > > > squid but allow direct (iptables protected) web access from the > > > client? > > > -- > > > John A. Sullivan III > > > Chief Technology Officer > > > Nexus Management > > > +1 207-985-7880 > > > john.sullivan@nexusmgmt.com > > > --- > > > > I use the bandwidth test-page of my provider... > > http://performance.chello.at:81 > > > > What do you mean with "direct" web access ? > > Web access via NAT ? > > I have entered the NAT-computer's IP as default gateway and the > > provider's DNS-servers as DNS-servers on my PC. > > I think this is what you mean with direct access... > > > > With this direct access i only get about 100kbit, when i > use squid or > > when i do the tests on the NAT-computer i have full > Bandwidth (around > > 1MBit/sec) > > > > I think there is a general problem with my configuration, > because the > > bandwidth is no better with iptables-scripts which are > known to work > > fine... > > > > I really don't know what to do anymore... > > > > Thanks in advance > > Florian St. > > As I look at it, unless you have significantly altered your > scripts, you are probably not using Squid. I see no rule to > redirect your web traffic to Squid. What happens if you > disable Squid? > > -- > John A. Sullivan III > Chief Technology Officer > Nexus Management > +1 207-985-7880 > john.sullivan@nexusmgmt.com > Oh no - i never wanted a transparent proxy. I only activated squid to check is there is a general problem with the configuration of my NICs To test this I entered the NAT-Computer's IP-address as proxy-address in my browser When I'm surfing with using the proxy - everything is fine - i have around 1MBit/sec When I access the internet directly (no proxy --> NAT) the speed is only about 100kBit/sec Thanks in advance Florian St. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: AW: AW: AW: bandwidth problems [Linux 2.4.20] [iptables 1.2.7a] 2004-02-12 7:16 ` AW: " root @ 2004-02-12 12:04 ` John A. Sullivan III 2004-02-12 22:46 ` AW: " root 0 siblings, 1 reply; 6+ messages in thread From: John A. Sullivan III @ 2004-02-12 12:04 UTC (permalink / raw) To: root; +Cc: netfilter On Thu, 2004-02-12 at 02:16, root@scheuchenstuel.com wrote: > > > > > > > Hi! > > > > > > > > > > > > > > My configuration: > > > > > > > ================= > > > > > > > > > > > > > > O-------------o O-----------------------o > > > > > > > | WinXP | | eth0 | eth1 | > > > > > > > | 10.10.1.100 |----| 10.10.1.254 | D H C P |----INTERNET > > > > > > > | | | | | > > > > > > > O-------------o O-----------------------o > > > > > > > My Computer My NAT-Computer > > > > > > > > > > > > > > NAT-Computer: > > > > > > > Linux 2.4.20-4GB > > > > > > > load average: 0.08, 0.05, 0.06 > > > > > > > iptables v1.2.7a > > > > > > > All the NICs I use are 3com 3C905-TX > > > > > > > > > > > > > > When I do some bandwidth tests on the NAT-Computer > > > > > > (provider's service > > > > > > > page) my bandwidth is about 1MBit/second When I do the > > > > same on my > > > > > > > computer I only get about 100kbit/second > > > > > > > > > > > > > > Now I wonder if there are any problems with my > > configuration...? > > > > > > > Would be nice if you could help me... > > > > > > > > > > > > > > Thanks in advance > > > > > > > Florian St. > > > > > > > > > > > > > > Root(AT)scheuchenstuel(DOT)com > > > > > > > > > > > > > > > > > > > > > My iptables-configuration: > > > > > > > ========================== > > > > > > > > > > > > > > > > > > > > > > > > > > #################################################################### > > > > > > ## > > > > > > > ###### > > > > > > > ###### > > > > > > > > > > > > > > #!/bin/bash > > > > > > > # > > > > > > > > > > > > > > modprobe iptable_nat > > > > > > > echo 1 > /proc/sys/net/ipv4/ip_forward > > > > > > > > > > > > > > ########## CLEARING TABLES > > > > > > > iptables -F > > > > > > > iptables -t nat -F > > > > > > > iptables -t mangle -F > > > > > > > iptables -X > > > > > > > > > > > > > > ########## SETTING POLICIES > > > > > > > iptables -P INPUT DROP > > > > > > > iptables -P OUTPUT ACCEPT > > > > > > > iptables -P FORWARD DROP > > > > > > > > > > > > > > ########## NAT > > > > > > > iptables -A INPUT -i eth1 -m state --state > > > > ESTABLISHED,RELATED -j > > > > > > > ACCEPT iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE > > > > > > > > > > > > > > ########## LOOPBACK SETTINGS > > > > > > > iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -s > > > > > > > 127.0.0.1/32 -j ACCEPT > > > > > > > > > > > > > > ########## EXTERNAL OPEN PORTS iptables -A INPUT -i eth1 -p > > > > > > > tcp --dport 80 -j ACCEPT > > > > > > > > > > > > > > ########## INTERNAL OPEN PORTS iptables -A INPUT -s > > > > > > > 10.10.1.100/32 -j ACCEPT > > > > > > > > > > > > > > ######### NAT FORWARDING > > > > > > > iptables -A FORWARD -s 10.10.1.100/32 -j ACCEPT iptables -A > > > > > > FORWARD -d > > > > > > > 10.10.1.100/32 -j ACCEPT > > > > > > > > > > > > > > > > > > > > > > > > > > #################################################################### > > > > > > ## > > > > > > > ###### > > > > > > > ###### > > > > > > > > > > > > The rules look a little unusual; in fact, they look downright > > > > > > dangerous. You may want to read a good iptables > > tutorial such > > > > > > as the one by Oskar Andreasson. You can find a link to it on > > > > > > the netfilter.org web site. You can also find some slide > > > > shows in the > > > > > > training section at http://iscs.sourceforge.net > > > > > > > > > > > > However, I do not think your rules would create a > > > > throughput problem. > > > > > > How are you measuring your throughput? > > > > > > -- > > > > > > John A. Sullivan III > > > > > > Chief Technology Officer > > > > > > Nexus Management > > > > > > +1 207-985-7880 > > > > > > john.sullivan@nexusmgmt.com > > > > > > --- > > > > > > > > > > Now i tried to use a script suggested by Oskar Andreasson > > > > > > > > > > > http://iptables-tutorial.frozentux.net/iptables-tutorial.html#RCFIRE > > > > WA > > > > > LLTXT > > > > > > > > > > But the problem is still the same... > > > > > I think there is another problem... > > > > > > > > > > When i configure&start squid on the NAT-Computer i have > > > > full bandwidth... > > > > > > > > > > I don't know what to do anymore... > > > > > > > > > > Thanks in advance > > > > > Florian St. > > > > How are you measuring your throughput? What happens if > > you don't use > > > > squid but allow direct (iptables protected) web access from the > > > > client? > > > > -- > > > > John A. Sullivan III > > > > Chief Technology Officer > > > > Nexus Management > > > > +1 207-985-7880 > > > > john.sullivan@nexusmgmt.com > > > > --- > > > > > > I use the bandwidth test-page of my provider... > > > http://performance.chello.at:81 > > > > > > What do you mean with "direct" web access ? > > > Web access via NAT ? > > > I have entered the NAT-computer's IP as default gateway and the > > > provider's DNS-servers as DNS-servers on my PC. > > > I think this is what you mean with direct access... > > > > > > With this direct access i only get about 100kbit, when i > > use squid or > > > when i do the tests on the NAT-computer i have full > > Bandwidth (around > > > 1MBit/sec) > > > > > > I think there is a general problem with my configuration, > > because the > > > bandwidth is no better with iptables-scripts which are > > known to work > > > fine... > > > > > > I really don't know what to do anymore... > > > > > > Thanks in advance > > > Florian St. > > > > As I look at it, unless you have significantly altered your > > scripts, you are probably not using Squid. I see no rule to > > redirect your web traffic to Squid. What happens if you > > disable Squid? > > > > -- > > John A. Sullivan III > > Chief Technology Officer > > Nexus Management > > +1 207-985-7880 > > john.sullivan@nexusmgmt.com > > > > Oh no - i never wanted a transparent proxy. > I only activated squid to check is there is a general problem with the > configuration of my NICs > To test this I entered the NAT-Computer's IP-address as proxy-address in my > browser > > When I'm surfing with using the proxy - everything is fine - i have around > 1MBit/sec > When I access the internet directly (no proxy --> NAT) the speed is only > about 100kBit/sec > > Thanks in advance > Florian St. Ah, interesting. What is the maximum bandwidth of your connection? I know it's a silly question for a test site that I'd imagine is not using cached data but could it be that the 1 Mbps results are somehow related to the cache? What happens if you connect a station directly to the Internet on your ISP's link? Do you see the same poor throughput? - John -- John A. Sullivan III Chief Technology Officer Nexus Management +1 207-985-7880 john.sullivan@nexusmgmt.com ^ permalink raw reply [flat|nested] 6+ messages in thread
* AW: AW: AW: AW: bandwidth problems [Linux 2.4.20] [iptables 1.2.7a] 2004-02-12 12:04 ` John A. Sullivan III @ 2004-02-12 22:46 ` root 0 siblings, 0 replies; 6+ messages in thread From: root @ 2004-02-12 22:46 UTC (permalink / raw) To: 'John A. Sullivan III'; +Cc: netfilter > > > > > > > > Hi! > > > > > > > > > > > > > > > > My configuration: > > > > > > > > ================= > > > > > > > > > > > > > > > > O-------------o O-----------------------o > > > > > > > > | WinXP | | eth0 | eth1 | > > > > > > > > | 10.10.1.100 |----| 10.10.1.254 | D H C P |----INTERNET > > > > > > > > | | | | | > > > > > > > > O-------------o O-----------------------o > > > > > > > > My Computer My NAT-Computer > > > > > > > > > > > > > > > > NAT-Computer: > > > > > > > > Linux 2.4.20-4GB > > > > > > > > load average: 0.08, 0.05, 0.06 > > > > > > > > iptables v1.2.7a > > > > > > > > All the NICs I use are 3com 3C905-TX > > > > > > > > > > > > > > > > When I do some bandwidth tests on the NAT-Computer > > > > > > > (provider's service > > > > > > > > page) my bandwidth is about 1MBit/second When I do the > > > > > same on my > > > > > > > > computer I only get about 100kbit/second > > > > > > > > > > > > > > > > Now I wonder if there are any problems with my > > > configuration...? > > > > > > > > Would be nice if you could help me... > > > > > > > > > > > > > > > > Thanks in advance > > > > > > > > Florian St. > > > > > > > > > > > > > > > > Root(AT)scheuchenstuel(DOT)com > > > > > > > > > > > > > > > > > > > > > > > > My iptables-configuration: > > > > > > > > ========================== > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > #################################################################### > > > > > > > ## > > > > > > > > ###### > > > > > > > > ###### > > > > > > > > > > > > > > > > #!/bin/bash > > > > > > > > # > > > > > > > > > > > > > > > > modprobe iptable_nat > > > > > > > > echo 1 > /proc/sys/net/ipv4/ip_forward > > > > > > > > > > > > > > > > ########## CLEARING TABLES iptables -F iptables > -t nat -F > > > > > > > > iptables -t mangle -F iptables -X > > > > > > > > > > > > > > > > ########## SETTING POLICIES iptables -P INPUT DROP > > > > > > > > iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP > > > > > > > > > > > > > > > > ########## NAT > > > > > > > > iptables -A INPUT -i eth1 -m state --state > > > > > ESTABLISHED,RELATED -j > > > > > > > > ACCEPT iptables -t nat -A POSTROUTING -o eth1 -j > > > > > > > > MASQUERADE > > > > > > > > > > > > > > > > ########## LOOPBACK SETTINGS iptables -A INPUT -i lo -j > > > > > > > > ACCEPT iptables -A INPUT -s > > > > > > > > 127.0.0.1/32 -j ACCEPT > > > > > > > > > > > > > > > > ########## EXTERNAL OPEN PORTS iptables -A > INPUT -i eth1 > > > > > > > > -p tcp --dport 80 -j ACCEPT > > > > > > > > > > > > > > > > ########## INTERNAL OPEN PORTS iptables -A INPUT -s > > > > > > > > 10.10.1.100/32 -j ACCEPT > > > > > > > > > > > > > > > > ######### NAT FORWARDING > > > > > > > > iptables -A FORWARD -s 10.10.1.100/32 -j ACCEPT > iptables > > > > > > > > -A > > > > > > > FORWARD -d > > > > > > > > 10.10.1.100/32 -j ACCEPT > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > #################################################################### > > > > > > > ## > > > > > > > > ###### > > > > > > > > ###### > > > > > > > > > > > > > > The rules look a little unusual; in fact, they look > > > > > > > downright dangerous. You may want to read a good iptables > > > tutorial such > > > > > > > as the one by Oskar Andreasson. You can find a > link to it > > > > > > > on the netfilter.org web site. You can also find > some slide > > > > > shows in the > > > > > > > training section at http://iscs.sourceforge.net > > > > > > > > > > > > > > However, I do not think your rules would create a > > > > > throughput problem. > > > > > > > How are you measuring your throughput? > > > > > > > -- > > > > > > > John A. Sullivan III > > > > > > > Chief Technology Officer > > > > > > > Nexus Management > > > > > > > +1 207-985-7880 > > > > > > > john.sullivan@nexusmgmt.com > > > > > > > --- > > > > > > > > > > > > Now i tried to use a script suggested by Oskar Andreasson > > > > > > > > > > > > > > > http://iptables-tutorial.frozentux.net/iptables-tutorial.html#RCFIRE > > > > > WA > > > > > > LLTXT > > > > > > > > > > > > But the problem is still the same... > > > > > > I think there is another problem... > > > > > > > > > > > > When i configure&start squid on the NAT-Computer i have > > > > > full bandwidth... > > > > > > > > > > > > I don't know what to do anymore... > > > > > > > > > > > > Thanks in advance > > > > > > Florian St. > > > > > How are you measuring your throughput? What happens if > > > you don't use > > > > > squid but allow direct (iptables protected) web > access from the > > > > > client? > > > > > -- > > > > > John A. Sullivan III > > > > > Chief Technology Officer > > > > > Nexus Management > > > > > +1 207-985-7880 > > > > > john.sullivan@nexusmgmt.com > > > > > --- > > > > > > > > I use the bandwidth test-page of my provider... > > > > http://performance.chello.at:81 > > > > > > > > What do you mean with "direct" web access ? > > > > Web access via NAT ? > > > > I have entered the NAT-computer's IP as default gateway and the > > > > provider's DNS-servers as DNS-servers on my PC. > > > > I think this is what you mean with direct access... > > > > > > > > With this direct access i only get about 100kbit, when i > > > use squid or > > > > when i do the tests on the NAT-computer i have full > > > Bandwidth (around > > > > 1MBit/sec) > > > > > > > > I think there is a general problem with my configuration, > > > because the > > > > bandwidth is no better with iptables-scripts which are > > > known to work > > > > fine... > > > > > > > > I really don't know what to do anymore... > > > > > > > > Thanks in advance > > > > Florian St. > > > > > > As I look at it, unless you have significantly altered > your scripts, > > > you are probably not using Squid. I see no rule to > redirect your web > > > traffic to Squid. What happens if you disable Squid? > > > > > > -- > > > John A. Sullivan III > > > Chief Technology Officer > > > Nexus Management > > > +1 207-985-7880 > > > john.sullivan@nexusmgmt.com > > > > > > > Oh no - i never wanted a transparent proxy. > > I only activated squid to check is there is a general > problem with the > > configuration of my NICs To test this I entered the NAT-Computer's > > IP-address as proxy-address in my browser > > > > When I'm surfing with using the proxy - everything is fine - i have > > around 1MBit/sec When I access the internet directly (no proxy --> > > NAT) the speed is only about 100kBit/sec > > > > Thanks in advance > > Florian St. > > Ah, interesting. What is the maximum bandwidth of your > connection? I know it's a silly question for a test site that > I'd imagine is not using cached data but could it be that the > 1 Mbps results are somehow related to the cache? What happens > if you connect a station directly to the Internet on your > ISP's link? Do you see the same poor throughput? - John > -- > John A. Sullivan III > Chief Technology Officer > Nexus Management > +1 207-985-7880 > john.sullivan@nexusmgmt.com > My provider gave me around 600kbit - a few days ago my provider sent me mail that the downstream-bandwidth was increased to 1MBit/sec There was also a link how to ensure to have 1MBit/sec I tested the bandwidth with downloading from another server which is NOT connected to my ISP directly - my connection HAS the speed of 1MBit, but Somehow the bandwidth is limited in my little iptables-NAT-computer.. Maybe i should try to install newer kernel and/or iptables !? But that's no solution of the problem... Nice Greetings from Austria (the really small country in europe - not the big one called "Australia" *lol*) Florian St. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2004-02-12 22:46 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <200402101943.i1AJhR9M012184@nmibwkms1.nexusmgmt.com>
2004-02-10 19:49 ` AW: bandwidth problems [Linux 2.4.20] [iptables 1.2.7a] John A. Sullivan III
2004-02-11 10:31 ` AW: " root
2004-02-11 15:52 ` John A. Sullivan III
2004-02-12 7:16 ` AW: " root
2004-02-12 12:04 ` John A. Sullivan III
2004-02-12 22:46 ` AW: " root
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox