Discuss December 2009

discuss@lists.centos.org

295 participants
271 discussions

Re: [CentOS] Optimizing CentOS for gigabit firewall
by sadas sadas 21 Dec '09

21 Dec '09

I will explain more deeply. I need to deploy a firewall(s) in front of web server farm because I need to do billing - I will use CentOS with iptables + ipset to store a list if my clients so when client doesn't pay his server's IP is out of the list and he can't access the web server. Second - I know that iptables is very heavy and it's not recommended to use it in gigabit firewall but I don't have a choice as far as I know only ipset works with iptables. I don't know can pf store 500 IPs in one list. Ipset is written for that purpose. I can't find information is there linux or BSD distribution with effective firewall that uses optimized algorithm to store hundreds of IPs and to forward huge traffic. Any idea? regards I'll second damn near everything nate said, and hopefully add a tidbit or two. If you're new to BSD, you may want to consider the pfsense project in the aforementioned active-active configuration. It gives you a nice, intuitive gui to manage your failover firewalls, if you insist on putting a firewall in front of your web servers. Better to secure the box, leave only the ports you need open on the public interfaces, and don't firewall them. Also, I'd strongly consider running your firewalls with no disk at all. A Live CD, CF card or USB Flash to boot off of, remote syslog and one less subsystem (disks) to buy/fail makes for some mighty cheap 1U servers. A single dual-core with core speeds above 3.0Ghz and 4GB of RAM is to pass Gb @ line rate - ethernet overhead. Truth be told, it's already being done on much less than that. You can also load balance your traffic, albiet somewhat primitively with it. If you really want massive throughput, consider toying around with extremely expensive 10G gear, size RAM appropriately, and see how PF performs under multi-processor, high-core speed. but if you're handling over a Gb of traffic and you can't split the application into multiple farms, that's the best move. Akamai, for instance, runs 10G to each rack, each rack has around 20-24 servers, and they run GB to the server. pfsense.org has extensive information about hardware requirements, features, and what you're looking to do. https://calomel.org/network_performance.html is an excellent BSD firewall performance site. One thing to note, you are claiming to want to deploy this as a passive bridge. You cannot do what you want to do running anything in bridge mode. The packets need to route somehow. Get a /29 from your colo provider and ask to have your existing block routed through it once you've tested it. Another option for a seamless failover, is to alias a different range of IP's to the server interfaces, put a /29 and whatever netblock you want to end up being your public IP block on the PFSense hardware. When you're convinced everything's working through rigorous testing, put a test domain up pointing to that block, modify virtualhost entries on the servers to respond to that domain with your production web site, and test some more. Once you're convinced that's working perfectly, make the changes in DNS to point your production domain at the IP's you want, and failover will happen with DNS convergence. Peter On Fri, Dec 18, 2009 at 9:06 AM, nate centos(a)linuxpowered.net > wrote: sadas sadas wrote: > > Hi, > I want to configure CentOS on powerful server with gigabit > adapters as transparent bridge and deploy it in front of server farm. > Can you tell how to optimize the OS for hight packet processing? What > configurations I need to do to achieve very hight speeds and thousands of > packets? iptables makes a TERRIBLE firewall, use pf instead http://www.openbsd.org/faq/pf/index.html Also consider how your going to provide redundancy, if you have a web server farm you want to protect them with at least two firewalls, not one. http://www.openbsd.org/faq/pf/carp.html I haven't used CARP myself but did setup a pair of pf firewalls about 5 years ago in a large network in bridging mode, the layer 3 fault tolerance was provided by OSPF on the core switches, the firewalls were active-active(with pfsync) since they were layer 2 only. Maybe someday linux will fix the overly complex iptables system to something that is more manageable, not holding my breath though. If you want really high speed(say multi GbE) though you'll want/need to go with an appliance based solution. Also since your referring to a web server farm, it is perfectly acceptable to not use firewalls these days, if you have a good load balancer that serves the same role as a firewall in that it only passes traffic that you specifically configure it to pass. Also in high traffic environments the performance of load balancers destroys most firewalls, making investing in a high end firewall a very expensive proposition. I've worked for the better part of the last 10 years with companies who did not have firewalls in front of their web servers for this reason, it didn't make sense $ wise, because the benefit wasn't there, and the added complexity, and performance implications wasn't worth it either. Talk to most load balancing companies and they'll tell you this themselves. nate

7 10

Re: [CentOS] Optimizing CentOS for gigabit firewall
by sadas sadas 21 Dec '09

21 Dec '09

What about NetBSD? I heard that NetBSD has the best network stack out there. Maybe NetBSD with pf is the best choice? >>> I can't find information is there linux or BSD distribution with effective >>> firewall that uses optimized algorithm to store hundreds of IPs and to >>> forward huge traffic. Any idea? >> >> Hundreds? >> >> http://www.openbsd.org/faq/pf/tables.html >> >> "A table is used to hold a group of IPv4 and/or IPv6 addresses. Lookups >> against a table are very fast and consume less memory and processor time >> than lists. For this reason, a table is ideal for holding a large group of >> addresses as the lookup time on a table holding 50,000 addresses is only >> slightly more than for one holding 50 addresses. Tables can be used in the >> following ways: >> >> * source and/or destination address in filter, NAT, and redirection rules. >> * translation address in NAT rules. >> * redirection address in redirection rules. >> * destination address in route-to, reply-to, and dup-to filter rule >> options." >> >> nuff said ? >> >> I love linux, I've been using it for almost 15 years now, I absolutely >> hate iptables(and ipchains, and ipfwadm). By contrast I absolutely >> hate everything about OpenBSD except for pf(which I love, ipfw and >> ipf aren't too bad either, at least for the era), so I use OpenBSD >> for firewalls, and linux for everything else. > >I can back this; during 2009, I deployed a bunch of load balancers >running OpenBSD (using pf, carpd, and relayd). I used to be a super die >hard BSD guy, but through the years and having used/deployed/propagated >NetBSD, then FreeBSD, then OpenBSD, then NetBSD again, I took one of my >usual once-a-year looks at GNU/Linux (this time, it was CentOS, after >having worked with RHEL for some years), I got settled here. > >Long story short: I'd really recommend OpenBSD for your task. iptables >really sucks. I recently deployed some machines running several virtual >instances (however still the cheapest *proven* way to get several IP >stacks in Linux) doing L2 routing, I threw iptables off of that machines >because it just can't handle stuff at that rate. OpenBSD rocks, I even >have a setup running (active-active, load balanced) at about 40Mbps >using Alix boards [0] -- they rock, and they are no way busy. > >OpenBSDs documentation is the best out there, it's documentational >quality is what I really really badly miss in the Linux world. However, >the community is a bunch of (sorry in advance) assholes. But this is >well known throughout the internet, so: You have been warned. Great >product, totally lame vendor. ;) > >Timo > >[0] -- http://pcengines.ch/alix.htm > >> nate >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos >

9 9

Re: [CentOS] Optimizing CentOS for gigabit firewall
by sadas sadas 21 Dec '09

21 Dec '09

>I've been using Linux (CentOS5) on gigabit firewalls, for thousands of >users. No problems. > >Just make sure ip_conntrack_max is big enough, so you don't run out of >connections. > >There are other things to tune to optimize the performance, but it's >certainly doable with linux+iptables. > >-- Pasi > Would you provide us information about how the firewalls are configured, the hardware, the total bandwidth passing the firewall in each direction and the connections in the busiest hours. regards

1 0

Optimizing CentOS for gigabit firewall
by sadas sadas 21 Dec '09

21 Dec '09

Hi, I want to configure CentOS on powerful server with gigabit adapters as transparent bridge and deploy it in front of server farm. Can you tell how to optimize the OS for hight packet processing? What configurations I need to do to achieve very hight speeds and thousands of packets?

7 6

Re: [CentOS] Optimizing CentOS for gigabit firewall
by sadas sadas 20 Dec '09

20 Dec '09

What solution for gigabit firewall can you suggest? Witch OS and packet filter is capable to atcheave hight performance and gigabit speeds? >Les Mikesell wrote: >> Timo Schoeler wrote: >>>> What about NetBSD? I heard that NetBSD has the best network stack out >>>> there. Maybe NetBSD with pf is the best choice? >>> NetBSD is a very nice OS, I personally like it most (out of all BSDs out >>> there); however, as can be read on >>> >>> http://www.netbsd.org/docs/network/pf.html >>> >>> there's the 'usual lag': OpenBSD implements feature X in 4.6, wait some >>> time to see it implemented elsewhere. >>> >>> One of the biggest strengths of OpenBSD is that it's really a completely >>> rounded piece of work. Keep it that way. pf will perform best on >>> OpenBSD, with all the nice features it has. >> >> Has anyone used Firewall Builder to create a complex set of iptables >> rules? Or compared performance where it built the same thing for >> linux/iptables and bsd/pf? >> > > >Are you joking? That piece of crap just puts everything into one single >chain. I never EVER use Firewall Builder after I saw the results the >first time. > >For a BRIDGING firewall, there is absolutely NO WAY that Linux/netfilter >can keep up with OpenBSD/pf. I doubt that Linux/netfilter can even reach >half the performance of OpenBSD/pf. >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos >

4 6

Supsend/hibernate on Samsung NC10
by Mathieu Baudier 20 Dec '09

20 Dec '09

Hi, I cannot have suspend and hibernate working on a Samsung NC10 (netbook) running CentOS 5.4 i386. When I try suspending/hibernating the screen becomes black (with a few logs, like "shrinking memory" for hibernate) and then the computer hangs and I have to force a shutdown with the power button. This wiki page seems to say that it should work out of the box: http://wiki.centos.org/HowTos/Laptops/Samsung/NC10 I tried to add the kernel arguments described here, to no avail: http://lists.centos.org/pipermail/centos/2007-June/040633.html Anyhow the problems doesn't seem to be the resume but rather getting into the suspended/hibernated state. When I log after a failed attempt, GNOME shows a popup saying that apparently we failed to recover from a suspend/hibernate state and that this may be a driver problem. A few more information about my settings which may be useful: - the root filesystem is installed on an LVM - I use the NetworkManager and not the network service - I disabled bluetooth (in order to remove all unused devices that may impact this problem) - [mbaudier@localhost ~]$ lshal | grep suspen org.freedesktop.Hal.Device.SystemPowerManagement.method_execpaths = {'hal-system-power-suspend', 'hal-system-power-suspend-clear-error', 'hal-system-power-hibernate', 'hal-system-power-hibernate-clear-error', 'hal-system-power-shutdown', 'hal-system-power-reboot', 'hal-system-power-set-power-save'} (string list) power_management.can_suspend_to_disk = true (bool) power_management.can_suspend_to_ram = true (bool) power_management.can_suspend = true (bool) Thanks in advance if somebody can tell me how I can analyse further / solve this. Cheers, Mathieu

2 1

mdadm help
by James Bensley 20 Dec '09

20 Dec '09

Hey List, So I had a 4 drive software RAID 5 set up consisting of /dev/sdb1, /dev/sdc1, /dev/sdd1 and /dev/sde1. I reinstalled my OS and after the reinstall I made the mistake of re-assembling the array incorrectly by typing "sudo mdadm --assemble /dev/md0 /dev/sdb /dev/sdc /dev/sdd /dev/sde" in a moment of stupidity. Obviously this didn't work and the array wouldn't mount and after a short period I realised my mistake and re-issuing the same command but specifying each drive partition (sdb1, sdc1 etc) instead of the drives (sdb, sdc etc) meant the raid would assembled and mount just dandy. My problem is that when I issue "sudo mdadm -E --scan" I get the following results: ARRAY /dev/md0 level=raid5 num-devices=4 UUID=fde94900:3f3f3bf6:e368bf24:bd0fce41 ARRAY /dev/md0 level=raid5 num-devices=4 UUID=3a2f1919:52f73b40:e368bf24:bd0fce41 These entries aren't in mdadm.conf but mdadm keeps picking up my first mistake and tries to make a raid out of my four drives and not the four partitions (the bottom line is the four UUIDs for the partitions on each drive, the top line is the four UUID for the drives). So now every time I restart the machine, the array isn't mounted because mdadm (I guess) doesn't know what to do as it has two sets of devices defined as /dev/md0. I can issues "sudo mdadm --stop /dev/md0" and "sudo mdadm --remove /dev/md0" and then re-assemble specifying the four partitions and carry on as normal but I can't work out how to tell mdadm to "forget" about the the top line of those results, if that makes any sence? I have removed the entries from fstab and from mdadm.conf so when I boot up the machine doesn't automatically try and mount the incorrect device but I still can't remove the top line from the results of "mdadm -E --scan" no matter what I do. I have rebooted and issued the command "sudo mdadm --assemble /dev/md1 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1" and I can mount my array as normal but I was hoping that now there wouldn't be a clash in the results of "sudo mdadm -E --scan" (which there isn't, the second lines says "/dev/md1"), meaning that after a reboot the array would mount properly but that isn't the case. It is still trying to assemble the top line. Does anyone have any idea how I can rectify this? Thanks for reading. -- Regards, James ;) Ted Turner - "Sports is like a war without the killing." - http://www.brainyquote.com/quotes/authors/t/ted_turner.html

1 1

Removable drive configuration
by Bob McConnell 20 Dec '09

20 Dec '09

I have a box running CentOS 5.3 with two Dataport removable drive bays installed on the second IDE interface (/dev/hdc and hdd). I want to configure it so I can plug in and mount various drives at different times, including different size drives. So far it will only recognize the first drive I plug in, and only if I boot the box after inserting the drive. Is there any way to set it up so I can mount different size drives freely without having to reboot each time? Thank you, Bob McConnell N2SPP

3 2

Re: [CentOS] Optimizing CentOS for gigabit firewall
by sadas sadas 20 Dec '09

20 Dec '09

The syntax is not a problem. The problem is in the performance. I suppose that if I configure OpenBSD to process the in/out packets only to layer 2 the performance will be much more than linux with iptables. >> I don't know jack about IPSet, but I know enabling or disabling hosts in >> bare stock PF without the gui in front of it is about as easy as it gets. > >IPTALES is the same; > >iptables -A [INPUT/FORWARD] -d -j [REJECT/DROP] > >> The PF configuration file syntax was designed from the ground up to be >> sane, unlike iptables, which typically needs some decent sysadmin scripting >> or using fwbuilder to make any good sense of. > >I beg to differ here. IPTABLES is not that hard when you understand it. Like >anything else, once you know what you are doing it isn't that hard. And no, >I have never used any GUI program to configure my firewalls. > >> There is no finer opensource firewall product on the market, in terms of >> performance, ease of configuration and use, and other issues. > >This is all subjective to the user. I would say that PF is a nightmare and >IPTABLES is easier to use. > >> If you're not opposed to vi, for what you're looking to accomplish, moving >> to BSD and pf is a no-brainer. PF can definitely handle a list of 500 >> hosts and anything else you've mentioned. It's absolutely capable, easier, >> and in general, for anything that involves packet filtering at all, about >> as good as it gets. > >Again this is all subjective to the user. > > >-- > >Regards >Robert > >Linux User #296285 >http://counter.li.org >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos >

4 4

xen domu not starting
by Peter Peltonen 20 Dec '09

20 Dec '09

After running out of swap and memory and freezing, a domU called web02 won't start up. Both dom0 and domU are running CentOS release 5.4. dom0's kernel is 2.6.18-164.el5xen and I'm running the stock xen from CentOS: xen-3.0.3-94.el5 After issuing 'xen create web02' I see the following in the xen console: Inode-cache hash table entries: 65536 (order: 6, 262144 bytes) vmalloc area: ee000000-f4ffe000, maxmem 2d800000 Memory: 1031328k/1056768k available (1478k kernel code, 16784k reserved, 548k data, 132k init, 311296k highmem) Checking if this processor honours the WP bit even in supervisor mode... Ok. Security Scaffold v1.0.0 initialized SELinux: Initializing. selinux_register_security: Registering secondary module capability Capability LSM initialized as secondary Mount-cache hash table entries: 512 (order: 0, 4096 bytes) CPU: L1 I cache: 32K, L1 D cache: 32K CPU: L2 cache: 6144K Enabling fast FPU save and restore... done. Enabling unmasked SIMD FPU exception support... done. Checking 'hlt' instruction... OK. CPU 1 irqstacks, hard=c0344000 soft=c0324000 Brought up 1 CPUs checking if image is initramfs... it is Freeing initrd memory: 1232k freed Grant table initialized NET: Registered protocol family 16 Initializing CPU#1 Brought up 2 VCPUs But after that it just hangs. SSH won't respond either. 'xm list' shows: web02 25 1023 2 -b---- 0.9 All I see in dom0's xend log is: Dec 20 13:18:10 kr kernel: device vif25.0 entered promiscuous mode Dec 20 13:18:10 kr kernel: ADDRCONF(NETDEV_UP): vif25.0: link is not ready Dec 20 13:18:12 kr kernel: blkback: ring-ref 8, event-channel 9, protocol 1 (x86_32-abi) Dec 20 13:18:12 kr kernel: ADDRCONF(NETDEV_CHANGE): vif25.0: link becomes ready Dec 20 13:18:12 kr kernel: xenbr0: topology change detected, propagating Dec 20 13:18:12 kr kernel: xenbr0: port 5(vif25.0) entering forwarding state In dom0's /var/log/messages I see: Dec 20 13:18:12 kr kernel: blkback: ring-ref 8, event-channel 9, protocol 1 (x86_32-abi) Dec 20 13:18:12 kr kernel: ADDRCONF(NETDEV_CHANGE): vif25.0: link becomes ready Dec 20 13:18:12 kr kernel: xenbr0: topology change detected, propagating Dec 20 13:18:12 kr kernel: xenbr0: port 5(vif25.0) entering forwarding state xm dmesg reports nothing unusual except these at the end: (XEN) mm.c:649:d22 Error getting mfn 3b6 (pfn 55555555) from L1 entry 00000000003b6025 for dom22 (XEN) mm.c:3341:d22 ptwr_emulate: fixing up invalid PAE PTE 00000000003b6025 But I've no idea when those messages have been created. I've disabled selinux in dom0. Other domUs are running fine, although I haven't tried rebooting them. Any ideas what could be wrong with the domU? Regards, Peter

1 0

← Newer
1
...
7
8
9
10
11
12
13
...
28
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss December 2009