Drop packet under heavy load incoming connections, also to ip's set as allowed

openaspace · 26 March 2020 23:09

Really thank you

{
"profile": {
    "bogomips": 6825.25, 
    "cpu": {
        "arch": "x86_64", 
        "count": 8, 
        "family": 15, 
        "flags": [
            "fpu", 
            "vme", 
            "de", 
            "pse", 
            "tsc", 
            "msr", 
            "pae", 
            "mce", 
            "cx8", 
            "apic", 
            "sep", 
            "mtrr", 
            "pge", 
            "mca", 
            "cmov", 
            "pat", 
            "pse36", 
            "clflush", 
            "mmx", 
            "fxsr", 
            "sse", 
            "sse2", 
            "ht", 
            "syscall", 
            "nx", 
            "lm", 
            "constant_tsc", 
            "nopl", 
            "xtopology", 
            "cpuid", 
            "tsc_known_freq", 
            "pni", 
            "cx16", 
            "pcid", 
            "x2apic", 
            "aes", 
            "hypervisor", 
            "lahf_lm", 
            "cpuid_fault", 
            "pti", 
            "ssbd", 
            "md_clear"
        ], 
        "model": 6, 
        "model_string": "Common KVM processor", 
        "speed": 3411.48, 
        "stepping": 1, 
        "vendor": "GenuineIntel"
    }, 
    "devices": [
        {
            "deviceclass": "c0300", 
            "driver": "uhci_hcd", 
            "model": "7020", 
            "sub_model": "1100", 
            "sub_vendor": "1af4", 
            "subsystem": "pci", 
            "vendor": "8086"
        }, 
        {
            "deviceclass": "60400", 
            "driver": null, 
            "model": "0001", 
            "sub_model": "0000", 
            "sub_vendor": "0000", 
            "subsystem": "pci", 
            "vendor": "1b36"
        }, 
        {
            "deviceclass": "60100", 
            "driver": null, 
            "model": "7000", 
            "sub_model": "1100", 
            "sub_vendor": "1af4", 
            "subsystem": "pci", 
            "vendor": "8086"
        }, 
        {
            "deviceclass": "20000", 
            "driver": "e1000", 
            "model": "100e", 
            "sub_model": "1100", 
            "sub_vendor": "1af4", 
            "subsystem": "pci", 
            "vendor": "8086"
        }, 
        {
            "deviceclass": "60400", 
            "driver": null, 
            "model": "0001", 
            "sub_model": "0000", 
            "sub_vendor": "0000", 
            "subsystem": "pci", 
            "vendor": "1b36"
        }, 
        {
            "deviceclass": "60000", 
            "driver": null, 
            "model": "1237", 
            "sub_model": "1100", 
            "sub_vendor": "1af4", 
            "subsystem": "pci", 
            "vendor": "8086"
        }, 
        {
            "deviceclass": "68000", 
            "driver": "piix4_smbus", 
            "model": "7113", 
            "sub_model": "1100", 
            "sub_vendor": "1af4", 
            "subsystem": "pci", 
            "vendor": "8086"
        }, 
        {
            "deviceclass": "20000", 
            "driver": "e1000", 
            "model": "100e", 
            "sub_model": "1100", 
            "sub_vendor": "1af4", 
            "subsystem": "pci", 
            "vendor": "8086"
        }, 
        {
            "deviceclass": "10180", 
            "driver": "ata_piix", 
            "model": "7010", 
            "sub_model": "1100", 
            "sub_vendor": "1af4", 
            "subsystem": "pci", 
            "vendor": "8086"
        }, 
        {
            "deviceclass": "30000", 
            "driver": null, 
            "model": "1111", 
            "sub_model": "1100", 
            "sub_vendor": "1af4", 
            "subsystem": "pci", 
            "vendor": "1234"
        }, 
        {
            "deviceclass": "10000", 
            "driver": "virtio-pci", 
            "model": "1004", 
            "sub_model": "0008", 
            "sub_vendor": "1af4", 
            "subsystem": "pci", 
            "vendor": "1af4"
        }, 
        {
            "deviceclass": null, 
            "driver": "usb", 
            "model": "0001", 
            "subsystem": "usb", 
            "vendor": "1d6b"
        }, 
        {
            "deviceclass": null, 
            "driver": "usb", 
            "model": "0001", 
            "subsystem": "usb", 
            "vendor": "0627"
        }, 
        {
            "deviceclass": "9/0/0", 
            "driver": "hub", 
            "model": "0001", 
            "subsystem": "usb", 
            "vendor": "1d6b"
        }, 
        {
            "deviceclass": "3/0/0", 
            "driver": "usbhid", 
            "model": "0001", 
            "subsystem": "usb", 
            "vendor": "0627"
        }
    ], 
    "hypervisor": {
        "vendor": "KVM"
    }, 
    "network": {
        "blue": false, 
        "green": true, 
        "orange": false, 
        "red": true
    }, 
    "system": {
        "kernel_release": "4.14.173-ipfire", 
        "language": "en", 
        "memory": 1991324, 
        "model": "Standard PC (i440FX + PIIX, 1996)", 
        "release": "IPFire 2.25 (x86_64) - core142", 
        "root_size": 33554432, 
        "vendor": "QEMU", 
        "virtual": true
    }
}, 
"profile_version": 0, 
"public_id": "3da230eedead754fc91291927b07d07c2f1464d0"

}

xperimental · 27 March 2020 01:50

“model_string”: “Common KVM processor”,
“hypervisor”: { “vendor”: “KVM” },

You use virtualization and propably share cpu cores that result in CPU waiting for IO = 100%.

jon · 27 March 2020 02:46

FYI - (and a picky item) from the Service Status Information it looks like IPS is still running…

Get rid of the VM and use a stand alone box for IPFire. VM is great for testing but I wouldn’t suggest using for this.

openaspace · 27 March 2020 09:54

Thank you. Ips is disabled when the stream is on. And activated when finish.

openaspace · 27 March 2020 09:56

Yes is a proxmox host, but if completely free…
The cpu is 90% free…

I can’t run ipfire standalone in a datacenter.

openaspace · 27 March 2020 10:08

How I can apply manual settings to increase performance of ipfire??

On the host I’m using this settings and the streaming vm is working correctly.

xperimental · 27 March 2020 10:13

That’s uninteresting in the case of “CPU waiting for IO” = 100% and you encounter that status many timers a day. The last time I’ve personally seen this is years ago and was hardware related. In your case it’s propably the CPU of the host doing other things with higher priority than your vm. But this is not good for ipfire.

Do you have any warnings or error messages in the kernel system log?

openaspace · 27 March 2020 12:03

so… i have poweroff ipfire and connected directly to the public ip the streaming vps…

i hope to have better performance…
today streaming day … i will write if i win or lose

openaspace · 27 March 2020 13:37

Could be nice to have qemu-guest-agent for ipifre running as vps…
I know that need time and a lot of job… but in a virtualized world have the full compatibility is a must have …

anon33261557 · 27 March 2020 14:11

ms · 27 March 2020 15:55

Hello,

it is not at all impossible to push a lot of packets through a virtual firewall. However, it will need some CPU time and of course use a lot of resources of the hypervisor.

If those resources are not available in realtime, clients and server applications will start retransmitting packets which will congest the line without much useful data traveling through it.

In order to have someone look at this properly, I would suggest that you get in touch with Lightning Wire Labs, have your environment assessed and then see what can be done.

pike_it · 27 March 2020 17:02

@ms sorry but as far as i can read, the issue is occuring into a VPS, not on “metal hardware”…

openaspace · 27 March 2020 17:59

Thank you for the support.
For your information I send you some screenshot of yesterday ip fire status on the hypervisor

.

openaspace · 27 March 2020 18:05

And this screenshots was the general hypervisor status when ipfire was under load.
The main host have 1gbps in/out badnwidth…

openaspace · 27 March 2020 18:17

here the down.

openaspace · 29 March 2020 16:51

Hello.
Whiteout IP fire, I have reached 900 Mbps out with 420 viewers for 12 hours without problems.

Anyone can advice me any simple interface firewall like ipfire to run without lag with proxmox?

ms · 30 March 2020 10:11

How can you run this without a firewall?

As I said, you seem to be running a more complex setup there. The hypervisor will be your bottleneck.

It will require more information on your setup and workload in order to remove that.

openaspace · 30 March 2020 11:55

Hi. I used the embed proxmox hypervisor firewall opening only the public stream port.
Others ports where the VPS receive my encoded video stream are locked to my source static IP. The only world visibile port is the stream port where the viewers connect to see the live video.

Inside the stream software platform i deny access to all non Italy ip’s and with hotlink protection and play locked to the specified domain , generating a time scheduled string code to append to the stream url.

In this way the only visibile port is the stream port, only italian ip can try to see the stream, the stream is webpage password protected and the video stream link player expire every 60 second from the first time compiled page.

It’s like to use the geo ip block of ipfire and lock incoming connections only for a specified source ip.

https://pve.proxmox.com/wiki/Firewall

openaspace · 30 March 2020 12:00

Also i have configured TCP BBR congestion control directly on the VPS

and enabled multiqueue to 8 cpu thread on the hypervisor for the VPS virtual ethernet card

openaspace · 30 March 2020 15:43

it remains in the sense that if I could use ipfire for these situations, it would be great in order to better manage the security