1

The problem I'm having is that I have a 500 mbps fiber line and it seems iptables is the bottleneck on my Linux workstation router (~200 mbps) when doing network address translations (NAT). Doing a speed test directly on the WAN VLAN gets me the full 500 mbps (more about the config below).

The workstation has a guest Virtualbox Linux machine that is NATing a LAN VLAN to the WAN VLAN on my Dell Enterprise S3048-ON switch. The host OS is Windows 10. By the way, it's using two logical interfaces but only using on physical port on the switch.

The specs on the workstation is a 16-core 1950X, 128GB RAM with an Intel I211-AT Gigabit LAN controller.

Also, I'm not sure if this matters for performance or not but for whatever reason VLAN tags get stripped before it gets to the Linux VM guest OS. To make it work I have to go to the Win10 device manager and create virtual interfaces that are assigned to the WAN VLAN and LAN VLAN then the Linux guest VM sees them as regular untagged ports and the Linux VM NATs between them.

Does the guest not having access to native VLANs create my performance issue?

Or do I simply have to upgrade to a better NIC perhaps? I'm not sure hardware recommendations are allowed here so what will I have to look for in a NIC if that's the case?

I've tried to look for answers but there's very little on this topic. If someone could provide more information to help me figure this out I'd be really thankful.

5
  • I do NAT through IPTABLES at gigabit speed on many atom box without issue. Windows 10 as a host really? I would bet a lot this is the problem.. but Windows 10 and Virtual Box are off-topic here.
    – JFL
    Feb 6, 2018 at 13:28
  • @JFL Yeah, it's a temporary solution for now since our main box died which didn't have such issues. (Was also not a VM). Where do you think it would be proper to ask further about this problem since W10 and VBox is off topic?
    – Tek
    Feb 6, 2018 at 13:43
  • 1
    For information otherwise in my company we have a pretty good stack running virtual VyOs routers on top of Ubuntu as hypervisor with KVM and OpenVSwitch. As said previously this kind of setup perform IPSEC VPN + NAT + OSPF at gigabit speed on an ATOM processor (3 years old) without any issue, so I really doubt the issue is with IPTABLES.
    – JFL
    Feb 6, 2018 at 14:04
  • 1
    Avoid NAT wherever possible. Don't ever double or triple NAT. Route instead. This includes on VM virtual networks. You've got IPv6; start using it. Feb 6, 2018 at 18:05
  • 1
    NAT is actually very resource intensive. Cisco does not provide NAT on layer-3 switches, only routers, because the routers have a hardware assist for NAT, and the switches do not.
    – Ron Maupin
    Feb 6, 2018 at 18:08

1 Answer 1

4

This would be better suited to a comment, but my current reputation prevents me from doing so. Here goes:

The NATTing would happen from IP to IP, which means some machine's IP which lies in your LAN VLAN would be able to access the internet by being NATTed to an IP which lies in the WAN VLAN. So, I don't think stripping the VLAN tags is something you should be too concerned with.

the NIC could be an issue, but I doubt it. You have a Gigabit NIC card and with a 500 mbps fiber line (which is the maximum throughput you can go up to), i think you are in the clear.

Coming to iptables, I agree this could be an issue. https://people.netfilter.org/kadlec/nftest.pdf here states that the performance of the boxes halved when being used for NAT.However, the performance was tested with a large number of chain rules. In your case, you might have a single public IP to which you are NATTing. I ran into a problem with iptables myself, but replaced it with Cisco's CSR1000v(licensed) since this was production. However, the company was paying and CISCO is expensive.

You could try some acceleration techniques mentioned below to see if it makes a difference. https://wiki.archlinux.org/index.php/High_Performance_Firewall as well as section 4.3 of https://people.netfilter.org/kadlec/nftest.pdf and see if it helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .