NAT
-
NAT problem:
We have a large, about 40 server that acting as a web browser over NAT connecting to client's web sites and harvesting statistics, each server may connect to up to 100 web pages simultaneously. Total numbers of states close to 100.000. All those stuff working over pfsense 1.2.3. NAT setting is default.
For improvement I have a new network where some portion of such servers transferred.
And 2.1-BETA1 Built On: Thu Mar 28 00:48:46 EDT 2013NAT: any -> IP EXT network/30 , Pool: Round robin with sticky Address,
Have a problem of intermittent deny connect from the servers to a web site. Opening a browser and the website spinning without a page show up. connection on the server in FIN_state. Restarting firewall appears to fix it, up to certain time. Then it appears again.Change NAT: any -> IP EXT network/30 , Pool: Source Hash
Total disaster, everything almost die, sporadically establish connection but overall no pass trough NAT.Now I switch to AUTO, it looks like simple network to single WAN address.
Will tell a result tomorrow.NAT pool feature definitely broken.
(a new test network generated about 15000 states, states changes 80-150 cps, approx 30 Mbit traffic)Oh a firewall in conservative mode … (old 123 and new 2.1), both has 16GB memory
Update 1 : The WAN NAT network defined as "Proxy ARP" , due to fail-over configuration. Is his may cause a problem ?
-
You seem to have a very specific use case and it needs tuning accordingly. Is this pfSense used for anything else apart from the client web site testing?
You could look at reducing the amount of time that a state exists - it is something like 5 minutes by default:
System: Advanced: Firewall and NAT -> Firewall Optimization Options. You could set this to aggressive. There are several other options on that page to change the way the states work.
Cheers
Jon -
You can't do proxy ARP with failover, if you have that setup on both systems you're creating an IP conflict, which would explain all your problems when NATing to those additional IPs. They'll have to be CARP IPs.
-
"You can't do proxy ARP with failover" - Thank you !!!!
That exactly was a problem ….. I just realize of constant proxy on BOTH servers, ( initially assuming such configuration is dynamically on/off on the second node )So the right steps:
1. create 3 CARP IP addresses
2. list this 3 IP addresses as 1 Alias
3. NAT any -> Alias pool from p.2
4. set pool optionCan someone advise a pool option (3 options) : round-robin sticky ; random sticky; hash ? (behind approx 40 crazy servers with 2-5K connections to outdide in a time frame)
Thank you all.