<div dir="ltr">No, the performance was a little shaky before, and after the ipf activation.<div>So I just disabled the firewall part.</div><div><br></div><div>The reason I activated the firewall is not for NAT, just to protect the box.</div> <div>As I have configured my router to portmap some ports into the HP server, and I use ipf to deny/accept by source.</div><div>As my stupid router firewall configuration never works.</div><div><br></div><div>The rules I used where :</div> <div><br></div><div><font size="1" face="arial, helvetica, sans-serif"># my HP server is 192.168.1.1</font></div><div><font size="1" face="arial, helvetica, sans-serif"># anti spoofing rule</font></div><div><font size="1" face="arial, helvetica, sans-serif">block in log quick on bge0 from 192.168.1.1 to any</font></div> <div><font size="1" face="arial, helvetica, sans-serif">#</font></div><div><font size="1" face="arial, helvetica, sans-serif"># Allow everything on loopbak</font></div><div><font size="1" face="arial, helvetica, sans-serif"># Rule 1 (lo0)</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick on lo0 proto icmp from any to any keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick on lo0 proto tcp from any to any keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick on lo0 proto udp from any to any keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick on lo0 from any to any</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass out quick on lo0 proto icmp from any to any keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass out quick on lo0 proto tcp from any to any keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass out quick on lo0 proto udp from any to any keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass out quick on lo0 from any to any</font></div> <div><font size="1" face="arial, helvetica, sans-serif">#</font></div><div><font size="1" face="arial, helvetica, sans-serif"># Rule 2 (global)</font></div><div><font size="1" face="arial, helvetica, sans-serif"># SSH Access to the host; useful ICMP</font></div> <div><font size="1" face="arial, helvetica, sans-serif"># types; ping request</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto icmp from any to 192.168.1.1 icmp-type 3 keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto icmp from any to 192.168.1.1 icmp-type 0 code 0 keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto icmp from any to 192.168.1.1 icmp-type 8 code 0 keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto icmp from any to 192.168.1.1 icmp-type 11 code 0 keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto icmp from any to 192.168.1.1 icmp-type 11 code 1 keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">#</font></div><div><font size="1" face="arial, helvetica, sans-serif"># Rule 4 (global)</font></div><div><font size="1" face="arial, helvetica, sans-serif"># Allow everything from these management hosts.</font></div> <div><font size="1" face="arial, helvetica, sans-serif"># blackbox:Policy:4: warning: Changing rule direction due to self reference</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto icmp from MANAGENETWORK_1 to 192.168.1.1 keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto icmp from MANAGENETWORK_2 to 192.168.1.1 keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto icmp from MANAGEHOST_1 to 192.168.1.1 keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto tcp from MANAGENETWORK_1 to 192.168.1.1 keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto tcp from MANAGENETWORK_2 to 192.168.1.1 keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto tcp from MANAGEHOST_1 to 192.168.1.1 keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto udp from MANAGENETWORK_1 to 192.168.1.1 keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto udp from MANAGENETWORK_2 to 192.168.1.1 keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick proto udp from MANAGEHOST_1 to 192.168.1.1 keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick from MANAGENETWORK_1 to 192.168.1.1</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass in quick from MANAGENETWORK_2 to 192.168.1.1</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass in quick from MANAGEHOST_1 to 192.168.1.1</font></div><div><font size="1" face="arial, helvetica, sans-serif">#</font></div><div><font size="1" face="arial, helvetica, sans-serif"># Rule 5 (global)</font></div> <div><font size="1" face="arial, helvetica, sans-serif"># Allow everything from the HP Server itself</font></div><div><font size="1" face="arial, helvetica, sans-serif"># blackbox:Policy:5: warning: Changing rule direction due to self reference</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass out quick proto icmp from 192.168.1.1 to any keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass out quick proto tcp from 192.168.1.1 to any keep state</font></div> <div><font size="1" face="arial, helvetica, sans-serif">pass out quick proto udp from 192.168.1.1 to any keep state</font></div><div><font size="1" face="arial, helvetica, sans-serif">pass out quick from 192.168.1.1 to any</font></div> <div><font size="1" face="arial, helvetica, sans-serif">#</font></div><div><font size="1" face="arial, helvetica, sans-serif"># Rule 6 (global)</font></div><div><font size="1" face="arial, helvetica, sans-serif">block in log quick from any to any</font></div> <div><font size="1" face="arial, helvetica, sans-serif">block out log quick from any to any</font></div><div><font size="1" face="arial, helvetica, sans-serif">#</font></div><div><font size="1" face="arial, helvetica, sans-serif"># Rule fallback rule</font></div> <div><font size="1" face="arial, helvetica, sans-serif"># fallback rule</font></div><div><font size="1" face="arial, helvetica, sans-serif">block in quick from any to any</font></div><div><font size="1" face="arial, helvetica, sans-serif">block out quick from any to any </font><br> </div></div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"> <p><br></p> <p><i><img src="http://januar.is/Content/img/logo_januar.png" width="96" height="34"></i></p> <p><br></p> <p><b>SVAVAR ÖRN EYSTEINSSON<br></b><font face="arial, helvetica, sans-serif" color="#999999">Kerfisstjóri<br>Gsm / mobile +354 862 1624<br>Sími / tel +354 531 0101 </font> </p> <p><b>Janúar markaðshús<br></b><a href="http://www.januar.is/" target="_blank">www.januar.is</a> / <a href="http://facebook.com/viderumjanuar" target="_blank">Facebook</a> </p></div></div> <br><br><div class="gmail_quote">On 26 March 2014 16:01, Dan McDonald <span dir="ltr"><<a href="mailto:danmcd@omniti.com" target="_blank">danmcd@omniti.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div class=""><br> On Mar 26, 2014, at 11:47 AM, Svavar Örn Eysteinsson <<a href="mailto:svavar@januar.is">svavar@januar.is</a>> wrote:<br> <br> > Hello people.<br> > I recently installed my first true NAS box at home, which is a HP Microserver N40L<br> > with 16GB in RAM, 1x250GB for OS and 4x 2TB Enterprise SATA disks provided by HP in a RAIDZ.<br> ><br> > I'm using the newest/updated OmniOS v11 r151008 and also Napp-it and other services.<br> > What I would like to know is, have there been any issues/problems and do people<br> > have some performance tuning tips regarding networking issues on the BC5723 controller provided<br> > by the HP Microserver ? It's the bge module/driver ?<br> ><br> > Sometimes I find the speeds to the BOX will rock up & down. I haven't configured<br> > a gigabit network, thats on the plan this weekend. I have full-duplex and flowctrl enabled.<br> > For an example, I noticed after building my small ipf firewall rules and enabled the firewall<br> > the speed did go down, specially with CIFS and NFS(didn't test the AFP).<br> <br> </div>Was performance okay pre-ipf? If so, it's probably ipf that's tripping you up.<br> <div class=""><br> > So, any performance tips out there ?<br> <br> </div>I have to ask, are you using ipf to protect the box? Or for NAT? If just to protect the box, you may be able to use something NOT ipf to help you out, depending on the problem(s) you're trying to solve.<br> <span class="HOEnZb"><font color="#888888"><br> Dan<br> <br> </font></span></blockquote></div><br></div>