CentOS6 NAT router/firewall behind a 120Mbps cable modem connection seems to be capping throughput at 30Mbps after recent updates and security "hardening".
Prior to updates and hardening I was getting 90Mbps.
I've checked CPU and network usage and neither of those seems to be a
tc does not show any traffic shaping going on and
I don't know how to troubleshoot this further.
I have a CentOS 6 system running as a NAT router/firewall behind a Comcast cable modem, which is also running as a NAT router
1000 100 eth1 eth0 Internet-------Modem-------------CentOS6-----------------LAN 10.0.0.0/24 192.168.10.0/24
The double NAT is a legacy from the CentOS system having previously served as a router/firewall behind a Time-Warner cable modem that ran in bridge mode. When I moved into Comcast territory I intended to switch the modem to bridge mode but never got around to it, and the double NAT never caused a problem. I was getting 90Mbps throughput with no issues.
In preparing to convert to bridged mode on the Comcast modem I decided to "harden" the CentOS system by disabling some unneeded services and doing "yum update", which I hadn't done in a while. After hardening I did a speed test and was surprised to find throughput down to 30Mbps.
I tried connecting my primary desktop system directly to the modem like this
eth1 eth0 Internet---Modem-------------CentOS6-----------------LAN | 10.0.0.0/24 192.168.10.0/24 | +--------------Desktop(Win7)
Running speedtest.net verified that my Comcast connection is capable of 120Mbps, so something I changed on the CentOS system has resulted in capping throughput at 30Mbps. Every time I do a speed test from the LAN (behind the CentOS system) I get a value within 1-2% of 30Mbps, so it almost feels like something is artificially capping throughput.
I thought maybe traffic shaping got enabled somehow, but
tc seems to
indicate it's not active
[jhg@perseus ~]$ sudo tc -s qdisc qdisc pfifo_fast 0: dev eth0 root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 Sent 64159459406 bytes 44745482 pkt (dropped 0, overlimits 0 requeues 0) rate 0bit 0pps backlog 0b 0p requeues 0 qdisc pfifo_fast 0: dev eth1 root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 Sent 2871293442 bytes 26151570 pkt (dropped 0, overlimits 0 requeues 0) rate 0bit 0pps backlog 0b 0p requeues 0
The "hardening" consisted of
- removing some unneeded packages
- shutting down unneeded services
- setting up iptables to filter all incoming traffic except for one non-standard port for ssh
- installing and configuring tripwire
redis dovecot redhat-lsb-compat ipa-client redhat-lsb nfs-utils-lib redhat-lsb-printing nfs-utils foomatic subversion foomatic-db spamassassin foomatic-db-ppds certmonger cups yp-tools mysql-server ypbind mysql rpcbind
Currently enabled services:
abrt-ccpp cpuspeed kdump nmb abrt-oops crond lvm2-monitor ntpd abrtd dhcpd mcelogd postfix acpid dkms_autoinstaller mdmonitor rsyslog atd haldaemon messagebus smb auditd ip6tables named sshd autofs iptables netfs sysstat blk-availability irqbalance network udev-post
My question is: What should I do next to figure out why my CentOS 6 router seems to be artificially capping throughput at 30Mbps?