Netfilter "Flow offload" / HW NAT

For Developers
101

Unfortunately, PPPoE connections cannot be bridged. Hence I was unable to set this up the way I wanted it to :frowning: Maybe it's possible somehow, but I couldn't get it to work. I did manage to kill my network multiple times xD

102

Could this be combined with HW QoS? The SoC has this feature as well and it seems that this would be at least something instead of SQM.

I didn’t take a look at the inner workings of hw flow offload yet, but I suppose it’s much easier then to integrate a full SQM implementation

103

Could also be very interesting, but probably a lot more work. I know my Dir-860l can shape at 600-700 mbit without PPPoE (by running iperf from a client on the LAN port to a second client on the WAN port), but with PPPoE it's stuck at around 350-400. Being able to offload PPPoE should be sufficient to bring this number up to 600-700 and possibly even more if the rest can be software offloaded, since the 600-700 figure was without any flow offloading. The software flow offloading should be compatible with SQM.

So as long as things aren't too intertwined, it should be possible to only offload PPPoE and make sure the packets still go through the q-disc.

104

I have the same problem. It seems the mtu/mss related problem.

105

has this patch fixed it? unfortunately, not for me.

106

Did you try mss clamping?

107

Does any one has the connection leak problem?
My router (Youhua WR1200JS, mt7621+mt7603e+mt7612e) running on OpenWrt 18.06 branch and has many active connections after enabled flow offloading (software or hardware).
After running several days, the active connections reach to 99%, and I have to reboot my router.
My router running these services below:

  1. Shadowsocks
  2. DDNS
  3. IPTV with vlan
  4. dnsmasq-full with customized configure file in 'conf-dir'
108

Yes, this issue has been mentioned by several people now. It happens both with regular and hw flow offloading. @nbd is there anything we can provide to help debug this issue?

109

I just upped maximum to 90000 and it stays around 55000, I see no impact on performance (using hw offload)

110

Please check if running this before starting connections helps with the connection leak problem:
sysctl -w net.netfilter.nf_conntrack_tcp_no_window_check=0

111

Thank you @nbd, I tried

sysctl -w net.netfilter.nf_conntrack_tcp_no_window_check=0

and my shadowsocks service was abnormal and no help with the leaking problem.

Today I recompiled my router's firmware. Before compiling, I did a

make dirclean

then the active connections seem no leaking problem, but I think I need more time to test it.
After one night, the connections reached to 5k+. :disappointed:

112

I've pushed a fix, please update and try again (without the sysctl command)
https://git.openwrt.org/68ab89854fede80ab6a4279204462d6b898a653f

2 Likes
113

I will compile & test this new commit tomorrow. Thank you very much for your work :slight_smile:

114

Compiled a new build with your fixes and currently testing it with hw flow offload enabled

115

@nbd, thanks. I'll cherry pick this commit to openwrt-18.06 branch and test it.

116

@nbd, this commit seems not fix the leak problem. After 1 hour, the active connections reached to 1000+.
Most of connections are UDP for dns resolve.

117

I not have anything problem with leak connections, even after 4 or 5 hours... with and without nbd commit.

118

I also haven't any problems with connection leaks, but i currently use a build with kernel 4.14.43 because i don't know if both wifi cards will work if i updaten to a recent build.

119

My only problem is related with many "Connection Reset" error, but I have this problem for months, and not is related Flow Offload..

120

@sotux, please show me the output of cat /proc/net/nf_conntrack when it has accumulated a large number of connections

1 Like