Network speed and IRQ affinity

Written at evening time in English • Tags: , ,

By default many Linux network interface card drivers set their SMP affinity mask to either all zeroes or all ones (“ff” — the length of the mask depends on the number of CPUs on the system). The former results in all queues and interfaces running on CPU ID 0, which can become a performance bottleneck due to insufficient computing power. The latter results in all queues and interfaces being scheduled on multiple CPUs, which can become a performance bottleneck due to increased CPU memory cache misses. (more…)

IPv6 with prefix delegation and VRFs

Written in the wee hours in English • Tags: , ,

DNA Welho has added IPv6 support to all their cable hookups on June 9th,1 which was a national IPv6 deployment flag day in Finland. I only heard about it from Facebook comments today. Until now I’ve had IPv6 disabled on the private VRF because my fast cable hookup only provided IPv4. Using IPv6 from the DSL hookup would have just slowed things down.

After some poking around I was able to get my VRF-separated home network connected using a delegated prefix. (more…)

No VRF-awareness for NAT with DHCP interfaces?

Written in the mid-afternoon in English • Tags: ,

I would like to forward SSH from my cable modem interface to an internal box in a different VRF, but this for some reason is only possible using static IP addresses. The global IP address in the NAT statement must be a static one to be able to also include a VRF reference.

This is what I would like to add:

ip nat source static tcp 10.0.0.11 22 interface Vlan6 22 vrf private extendable

However, neither “vrf” nor “extendable” is allowed after “interface” has been entered.

Yet, if Vlan6 has the IP address 192.0.2.123 from DHCP, I can add the following static NAT entry and it works as one would expect:

ip nat source static tcp 10.0.0.11 22 192.0.2.123 22 vrf private extendable

I don’t see why it wouldn’t be possible to add the VRF to an entry that uses an interface reference for the global IP address. (more…)

L2TP over IPsec on Cisco IOS

Written in the mid-afternoon in English • Tags: , , , , ,

I wanted to use the OS X VPN client to connect to my home network while on the road. I guess using an OS X server would be the easiest way to get a Mac-compatible VPN server up and running. Using a Cisco running IOS required quite a few lines of configuration.

The OS X VPN client provides terrible feedback. It will happily tell you that there was “no response from the VPN server” when in reality the server responds with a rejection of all the ISAKMP or IPsec transforms proposed by the client. Fortunately both the Cisco debugging messages and verbose output from tcpdump were quite helpful.

In about 3 hours I got it all working, including routing with other VRFs and DMVPN sites. (more…)

Unbound not resolving

Written in the mid-morning in English • Tags: , , , ,

I’m not sure what failed last night, but I’m guessing the cable Internet connection was down. Interestingly, unbound had stopped resolving even local zones configured with stub-zone and stub-addr directives. This was unexpected: stub-zones are supposed to work “without referring to the public Internet” per the unbound.conf manual page.

To mitigate the issue I wanted to have backup name servers in resolv.conf (ones using a different Internet connection) even on the resolving name server hosts themselves. With resolvconf that boiled down to creating /etc/default/resolvconf with the following setting in it:

TRUNCATE_NAMESERVER_LIST_AFTER_LOOPBACK_ADDRESS=no

This way name servers configured in /etc/network/interfaces (using dns-nameservers directives) are included in resolv.conf even when unbound has been started.

However, this is a poor workaround, as I don’t have multiple Internet connections at every site.

»
After some too-frequent freezing of my Cisco 877 routers I’ve downgraded them from 15.1M to 12.4T. As they are EOL already, it’s time to look for replacements.
»
How to create an L2TP IPsec tunnel to NetBSD so it works with your Android phone, iPhone or other iOS device, Mac OS X, and a bunch of other things as well.
»
CloudFlare must be rolling out new changes: I’ve seen the NetBSD Planet fail with a “cloudflare-nginx” generated “500 Internal Server Error” for an hour or two the past couple of nights. Last night at around 9pm UTC it happened again and didn’t recover. I changed the backend from an IPv6 address to IPv4 and that brought the site back. Eventually we’ll have to live with just IPv6 addresses, so this is an unfortunate regression on CloudFlare’s part.
»
Linksys SPA942 phones reboot on DHCP lease renewal even if the lease information does not change (apart from the obvious timestamps). Increased lease time to 1 week for all phones.

Staying connected on the train

Written early in the evening in English • Tags: , , ,

VR-junaverkko blocks most outgoing ports, which is a repeating source of annoyance when traveling. I would think that a traffic shaping approach would be more effective, but maybe I don’t have a sufficient understanding of their bandwith limitations. (more…)