Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My OpenBSD 4.6 pf firewall has started having really bad performance in the past few weeks. I've isolated the firewall (as opposed to the WAN connection, switch, cable, etc.) as the problem, but need a hint on how to further diagnose or fix the problem.

The facts:

Normal setup is: DSL Modem -> FW Ext. NIC -> FW Int. NIC -> Switch -> Laptop

  1. Normal setup described above gives only 25 Kbps!

  2. Plugging the laptop straight from the DSL modem gives a 1 MBps connection (full speed, as advertised). Therefore, the DSL connection seems to be OK.

  3. Plugging the laptop directly into the firewall's internal NIC (bypassing the switch) also gives only 25 Kbps. Therefore, the switch does not seem to be a problem.

  4. I've replaced the ethernet cables, but it didn't help.

  5. Here's the weird thing. Reloading the ruleset (/sbin/pfctl -Fa -f /etc/pf.conf) causes the laptop's connection to go up to 1 Mbps (i.e. full speed) for a few minutes before it gradually degrades back down to 25Kbps again.

Any ideas on what's wrong or how I could further diagnose the problem?

share|improve this question
Can you edit and post a sudo pfctl -s info from BSD when you get the slow down? – Paul Jan 10 '12 at 22:54

Most likely you have a suboptimal MTU setting or incorrect autoset of this value so packets get fragmented which can cause serious performance degradation see some hints Not sure about exact openbsd syntax but you can define packet size for ping and see if packets get fragmented gradually decreasing the value to find the largest one which does not cause fragmentation. See this blog for example. Otherwise just try to blindly lower the MTU value with ifconfig to say 1300 and see if it has any effect. You can also calculate the value based on encapsulation, but it is probably quicker with trial/error method.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .