Slow internal LAN web traffic with PFSense
-
Not sure why. If the DNS returned internal address (assuming they are on the same subnet) then the traffic should never have gotten to the firewall at all. If you were going to DMZ from a LAN for instance, then it would go through the firewall, but NAT reflection would not have much to do here. You could even switch to advanced outbound NAT and not NATed for that traffic at all, just pure firewall and routing.
What it seemed like was happening was the web server was spending time trying to maintain dropped connections to the outside at the expense of inside connections - which should never touch the firewall. All internal machines used an internal DNS server that specified the IP for the web server that was on the same subnet. It looks like the symptoms we were seeing were indirectly related to the reflective NAT issue. For some reason there were tons of connections between the server and itself trying to loop back over an external address–-my best guess is that something somewhere was hardcoded to talk over that IP. But if that were the case, removing NAT reflection would not resolve the issue - it would still try and talk out and back and be blocked. I'm still at a loss to the exact mechanism of the problem but any speculation to help others in the future is welcome.
-
What it seemed like was happening was the web server was spending time trying to maintain dropped connections to the outside at the expense of inside connections - which should never touch the firewall. All internal machines used an internal DNS server that specified the IP for the web server that was on the same subnet. It looks like the symptoms we were seeing were indirectly related to the reflective NAT issue. For some reason there were tons of connections between the server and itself trying to loop back over an external address–-my best guess is that something somewhere was hardcoded to talk over that IP. But if that were the case, removing NAT reflection would not resolve the issue - it would still try and talk out and back and be blocked. I'm still at a loss to the exact mechanism of the problem but any speculation to help others in the future is welcome.
My guess would be that the html/php/asp is telling the client to go to http://<externalip>/internalpage.html/php/asp instead of ./internalpage.html/php.asp and as a result you where getting essentially redirected to the external ip instead of it using the internal ip from DNS. This happens sometimes when your webpage needs to load data from another page. This is generally the wrong way to setup a website IMO.</externalip>