Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NANOG: users

Linux Router distro's with dual stack capability

 

 

NANOG users RSS feed   Index | Next | Previous | View Threaded


bpfankuch at cpgreeley

Feb 10, 2010, 4:12 PM

Post #1 of 19 (2734 views)
Permalink
Linux Router distro's with dual stack capability

Anyone have some insight on a good dual stack Linux (or BSD) router distro? Currently using IPCop but it lacks ipv6 support. I've used SmoothWall Express but not in some time and not sure how well it works with IPv6. Not looking for something huge, just something for the equivalent of a small branch office. Site to Site VPN support and NAT translation capability for a few public IP addresses to private addresses are the only requirements. Public or private responses are welcome!

Thanks!
Blake Pfankuch
Network Engineer


sparctacus at gmail

Feb 10, 2010, 4:17 PM

Post #2 of 19 (2658 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

would pfsense work for you?



On Wed, Feb 10, 2010 at 4:12 PM, Blake Pfankuch <bpfankuch [at] cpgreeley> wrote:
> Anyone have some insight on a good dual stack Linux (or BSD) router distro?  Currently using IPCop but it lacks ipv6 support.  I've used SmoothWall Express but not in some time and not sure how well it works with IPv6.  Not looking for something huge, just something for the equivalent of a small branch office.  Site to Site VPN support and NAT translation capability for a few public IP addresses to private addresses are the only requirements.  Public or private responses are welcome!
>
> Thanks!
> Blake Pfankuch
> Network Engineer
>
>


damin at nacs

Feb 10, 2010, 4:18 PM

Post #3 of 19 (2658 views)
Permalink
RE: Linux Router distro's with dual stack capability [In reply to]

>Anyone have some insight on a good dual stack Linux (or BSD) router distro?
Currently using IPCop but it lacks ipv6 >support. I've used SmoothWall
Express but not in some time and not sure how well it works with IPv6. Not
looking for >something huge, just something for the equivalent of a small
branch office. Site to Site VPN support and NAT >translation capability for
a few public IP addresses to private addresses are the only requirements.
Public or private >responses are welcome!

Not sure if they support IPV6 or not, but Imagestream makes Linux based
routers, and everyone I've ever talked to that owns one has nothing bad to
say about them.


wadeb at cupofcompassion

Feb 10, 2010, 4:21 PM

Post #4 of 19 (2656 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

Sorry for the top post,
BB won't let me punch this at the bottom.
I believe 2.0 is in beta and supports ipv6,
I don't know if beta is something you want to mess around with. The PF products have been bulletproof for quite a long time.

-W
------Original Message------
From: Bryan Irvine
To: Blake Pfankuch
Cc: nanog [at] nanog
Subject: Re: Linux Router distro's with dual stack capability
Sent: Feb 10, 2010 16:17

would pfsense work for you?



On Wed, Feb 10, 2010 at 4:12 PM, Blake Pfankuch <bpfankuch [at] cpgreeley> wrote:
> Anyone have some insight on a good dual stack Linux (or BSD) router distro?  Currently using IPCop but it lacks ipv6 support.  I've used SmoothWall Express but not in some time and not sure how well it works with IPv6.  Not looking for something huge, just something for the equivalent of a small branch office.  Site to Site VPN support and NAT translation capability for a few public IP addresses to private addresses are the only requirements.  Public or private responses are welcome!
>
> Thanks!
> Blake Pfankuch
> Network Engineer
>
>



Wade Blackwell
Sent from Mobile
805-457-8825 X998
cupofcompassion.com
Coffee that makes a difference


mprice at tqhosting

Feb 10, 2010, 4:29 PM

Post #5 of 19 (2661 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

On Wed, Feb 10, 2010 at 7:12 PM, Blake Pfankuch <bpfankuch [at] cpgreeley> wrote:
> Anyone have some insight on a good dual stack Linux (or BSD) router distro?

Mikrotik RouterOS. It is based on Linux and a bit more feature-rich
than some of the linux router distros I've tried such as IPCop.
Licenses costs a few bucks but its worth it IMHO.



Regards,

Mark


aaron+nanog at heyaaron

Feb 10, 2010, 5:06 PM

Post #6 of 19 (2656 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

On 2010-02-10 at 17:12:28 -0700, Blake Pfankuch wrote:
> Anyone have some insight on a good dual stack Linux (or BSD) router distro? Currently using IPCop but it lacks ipv6 support. I've used SmoothWall Express but not in some time and not sure how well it works with IPv6. Not looking for something huge, just something for the equivalent of a small branch office. Site to Site VPN support and NAT translation capability for a few public IP addresses to private addresses are the only requirements. Public or private responses are welcome!

I'm not sure if the GUI is a requirement, but I'm a huge fan of Shorewall.
It has support for both v4 and v6 along along with the usual router
requirements. Since it's just a linux box with a few iptables rules, you
can easily load openvpn, ipsec, quagga, etc...

It's all text files and a 'shorewall start|stop|check' script.

If you want something with a GUI, pfSense is your best bet, or you could
use something like fwbuilder to build your iptables rules.

-A


carloscarnero at gmail

Feb 10, 2010, 8:19 PM

Post #7 of 19 (2653 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

Have you checked Vyatta?

HTH,
Carlos.


bpfankuch at cpgreeley

Feb 10, 2010, 9:02 PM

Post #8 of 19 (2658 views)
Permalink
RE: Linux Router distro's with dual stack capability [In reply to]

I actually spaced about vyatta when I wrote this email. I have since been forcefully reminded. About 30 times :) In the process of testing it, however my main concern is some of the complexity of the config options. The GUI is a welcome addition since 4, however I still find it a bit lacking. I may go the vyatta route anyway based only on my sheer curiosity and future possible needs.

Thank you all for your input!

-----Original Message-----
From: Carlos A. Carnero Delgado [mailto:carloscarnero [at] gmail]
Sent: Wednesday, February 10, 2010 9:19 PM
To: Blake Pfankuch
Cc: nanog [at] nanog
Subject: Re: Linux Router distro's with dual stack capability

Have you checked Vyatta?

HTH,
Carlos.


p.vanarkel at gmail

Feb 11, 2010, 12:05 AM

Post #9 of 19 (2660 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

On Wed, 10 Feb 2010, Bryan Irvine wrote:

> would pfsense work for you?

pfSense has ipv6, since it's essentially just a freebsd kernel with a
layer on top. However, ipv6 support in the GUI is fairly minimal to
non-existant, and I wouldn't recommend it if you really want to use
ipv6.
Mind you, I'm a fan of pfSense, it's just too bad it's not
ipv6-friendly :)

--
Peter van Arkel
T: +31 623988844 | p.vanarkel [at] gmail
RIPE: PvA63-RIPE | PGP: 0xA0991D6B


nenolod at systeminplace

Feb 11, 2010, 12:23 AM

Post #10 of 19 (2645 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

On Wed, 2010-02-10 at 17:12 -0700, Blake Pfankuch wrote:
> Anyone have some insight on a good dual stack Linux (or BSD) router distro? Currently using IPCop but it lacks ipv6 support. I've used SmoothWall Express but not in some time and not sure how well it works with IPv6. Not looking for something huge, just something for the equivalent of a small branch office. Site to Site VPN support and NAT translation capability for a few public IP addresses to private addresses are the only requirements. Public or private responses are welcome!

We are having moderate success with IPv6 on Vyatta, but we have seen
neighbour discovery glitches in the current production images.

The prerelease subscription code crashes on our vyatta appliances, so we
haven't tested that yet.

William


jack at crepinc

Feb 11, 2010, 10:05 AM

Post #11 of 19 (2624 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

Lots of people roll FreeBSD with Quagga/pf/ipfw for dual stack. See
the freebsd-isp list.

-Jack Carrozzo

On Thu, Feb 11, 2010 at 3:23 AM, William Pitcock
<nenolod [at] systeminplace> wrote:
> On Wed, 2010-02-10 at 17:12 -0700, Blake Pfankuch wrote:
>> Anyone have some insight on a good dual stack Linux (or BSD) router distro?  Currently using IPCop but it lacks ipv6 support.  I've used SmoothWall Express but not in some time and not sure how well it works with IPv6.  Not looking for something huge, just something for the equivalent of a small branch office.  Site to Site VPN support and NAT translation capability for a few public IP addresses to private addresses are the only requirements.  Public or private responses are welcome!
>
> We are having moderate success with IPv6 on Vyatta, but we have seen
> neighbour discovery glitches in the current production images.
>
> The prerelease subscription code crashes on our vyatta appliances, so we
> haven't tested that yet.
>
> William
>
>
>


nenolod at systeminplace

Feb 11, 2010, 2:12 PM

Post #12 of 19 (2618 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

Hi,

On Thu, 2010-02-11 at 13:05 -0500, Jack Carrozzo wrote:
> Lots of people roll FreeBSD with Quagga/pf/ipfw for dual stack. See
> the freebsd-isp list.

FreeBSD's network stack chokes up in DDoS attacks due to interrupt
flooding. We used to use FreeBSD for firewalling and basic routing, but
when noticing that we had horizontal scalability (e.g. a Celeron 667mhz
performed nearly as well as a dual dual-core Xeon system when DDoS
attacks happened), we switched to Vyatta, and generally have not looked
back.

William


cra at WPI

Feb 11, 2010, 3:20 PM

Post #13 of 19 (2618 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

On Thu, Feb 11, 2010 at 04:12:03PM -0600, William Pitcock wrote:
> On Thu, 2010-02-11 at 13:05 -0500, Jack Carrozzo wrote:
> > Lots of people roll FreeBSD with Quagga/pf/ipfw for dual stack. See
> > the freebsd-isp list.
>
> FreeBSD's network stack chokes up in DDoS attacks due to interrupt
> flooding. We used to use FreeBSD for firewalling and basic routing, but
> when noticing that we had horizontal scalability (e.g. a Celeron 667mhz
> performed nearly as well as a dual dual-core Xeon system when DDoS
> attacks happened), we switched to Vyatta, and generally have not looked
> back.

Have you tried using FreeBSD's polling mode instead of interrupt mode?

No experience with it myself, but it sounds cool:

http://info.iet.unipi.it/~luigi/polling/


marty.anstey at sunwave

Feb 11, 2010, 3:28 PM

Post #14 of 19 (2625 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

William Pitcock wrote:
> FreeBSD's network stack chokes up in DDoS attacks due to interrupt
> flooding. We used to use FreeBSD for firewalling and basic routing, but
> when noticing that we had horizontal scalability (e.g. a Celeron 667mhz
> performed nearly as well as a dual dual-core Xeon system when DDoS
> attacks happened), we switched to Vyatta, and generally have not looked
> back.
>
> William
>
>
Which version of FreeBSD and how much traffic/pps?

I believe that there has been significant improvements to the networking
stack in recent versions of FreeBSD, plus there are also a lot of sysctl
tunables which can significantly improve networking performance. I have
a hard time believing that the networking performance of recent versions
of FreeBSD would not be competitive in comparison to other unixes.

-M


oberman at es

Feb 11, 2010, 3:46 PM

Post #15 of 19 (2615 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

> Date: Thu, 11 Feb 2010 18:20:13 -0500
> From: Chuck Anderson <cra [at] WPI>
>
> On Thu, Feb 11, 2010 at 04:12:03PM -0600, William Pitcock wrote:
> > On Thu, 2010-02-11 at 13:05 -0500, Jack Carrozzo wrote:
> > > Lots of people roll FreeBSD with Quagga/pf/ipfw for dual stack. See
> > > the freebsd-isp list.
> >
> > FreeBSD's network stack chokes up in DDoS attacks due to interrupt
> > flooding. We used to use FreeBSD for firewalling and basic routing, but
> > when noticing that we had horizontal scalability (e.g. a Celeron 667mhz
> > performed nearly as well as a dual dual-core Xeon system when DDoS
> > attacks happened), we switched to Vyatta, and generally have not looked
> > back.
>
> Have you tried using FreeBSD's polling mode instead of interrupt mode?
>
> No experience with it myself, but it sounds cool:
>
> http://info.iet.unipi.it/~luigi/polling/
>

Polling is excellent for low speed lines, but for Gig and faster, most
newer interfaces support interrupt coalescing. This easily resolves the
issue in hardware as interrupts are only issued when needed but limited
to a reasonable rate, Polling does not use interrupts, but consumes
system resources regardless of traffic.

FreeBSD has supported polling for a long time (V6?) and interrupt
coalescing since some release of V7. (Latest release is V8.)
--
R. Kevin Oberman, Network Engineer
Energy Sciences Network (ESnet)
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)
E-mail: oberman [at] es Phone: +1 510 486-8634
Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751


ras at e-gerbil

Feb 11, 2010, 4:41 PM

Post #16 of 19 (2617 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

On Thu, Feb 11, 2010 at 03:46:13PM -0800, Kevin Oberman wrote:
> Polling is excellent for low speed lines, but for Gig and faster, most
> newer interfaces support interrupt coalescing. This easily resolves the
> issue in hardware as interrupts are only issued when needed but limited
> to a reasonable rate, Polling does not use interrupts, but consumes
> system resources regardless of traffic.
>
> FreeBSD has supported polling for a long time (V6?) and interrupt
> coalescing since some release of V7. (Latest release is V8.)

I'm pretty sure it's been around for a lot longer than that. I seem to
recall playing with both back in 4.x. Of course interrupt coalescing is
mostly a function of the NIC (though some driver involvement is required
to take advantage of it), so the quality of the implementations have
varied significantly over the years. The first generation GE NICs which
offered it didn't do a particularly good job with it though, so for
example it was still possible to cripple a box with high interrupt
rates while the same box would be perfectly fine with polling.

That said, I think your use case for polling is backwards. As you say,
"normally" the NIC fires off an interrupt every time a packet is
received, and the kernel stops what it is doing to process the new
packet. On a low speed (or at least low traffic) interface this isn't a
problem, but as the packet/sec rate increases the amount of time wasted
as interrupt processing "overhead" becomes significant. For example,
even a GE interface is capable of doing 1.488 million packets/sec.

By switching to a polling based model, you switch off the interrupt
generation completely and simply check the NIC for new packets a set
rate (for example, 1000 times/sec). This gives you a predictable and
consistent CPU use, so even if you had 1.488M/s interrupts coming in you
would still only be checking 1000 times/sec. If you did less than
1000pps it would be a net increase in CPU, but if you do more (or ever
risk doing more, such as during a DoS attack) it could be a net benefit.
This is makes the most sense for people doing a lot of traffic
regardless.

Of course the downside is higher latency, since you're delaying the
processing of the packet by some amount of time after it comes in. In
the 1000 times/sec example above, you could be delaying processing of
your packet by up to 1ms. For most applications this isn't enough to
cause any harm, but it's something to keep in mind. Interrupt coalescing
works around the problem of large interrupt rates by simply having the
NIC limit the number of interrupts it generates under load, giving you
the benefits of low-latency processing and low-interrupt rate under high
load. I haven't played with this stuff in many many years, so I'm sure
modern interrupt coalescing is much better than it used to be, and the
extra work of configuring polling and dealing with the potential
latency/jitter implications isn't worth the benefits for most people. :)

--
Richard A Steenbergen <ras [at] e-gerbil> http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)


jack at crepinc

Feb 11, 2010, 7:36 PM

Post #17 of 19 (2604 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

Also IIRC you can tune the hash cache / tree algorithm - ie if your
traffic is mostly a few addresses then the default prefix search is
fine (with the caching) but for more sparse traffic as you'd see at an
edge, disabling the cache and using the other algo proved a lot
faster. There's a paper on this I saw a few years ago, will forward if
I find it.

-Jack Carrozzo

On Thu, Feb 11, 2010 at 7:41 PM, Richard A Steenbergen <ras [at] e-gerbil> wrote:
> On Thu, Feb 11, 2010 at 03:46:13PM -0800, Kevin Oberman wrote:
>> Polling is excellent for low speed lines, but for Gig and faster, most
>> newer interfaces support interrupt coalescing. This easily resolves the
>> issue in hardware as interrupts are only issued when needed but limited
>> to a reasonable rate, Polling does not use interrupts, but consumes
>> system resources regardless of traffic.
>>
>> FreeBSD has supported polling for a long time (V6?) and interrupt
>> coalescing since some release of V7. (Latest release is V8.)
>
> I'm pretty sure it's been around for a lot longer than that. I seem to
> recall playing with both back in 4.x. Of course interrupt coalescing is
> mostly a function of the NIC (though some driver involvement is required
> to take advantage of it), so the quality of the implementations have
> varied significantly over the years. The first generation GE NICs which
> offered it didn't do a particularly good job with it though, so for
> example it was still possible to cripple a box with high interrupt
> rates while the same box would be perfectly fine with polling.
>
> That said, I think your use case for polling is backwards. As you say,
> "normally" the NIC fires off an interrupt every time a packet is
> received, and the kernel stops what it is doing to process the new
> packet. On a low speed (or at least low traffic) interface this isn't a
> problem, but as the packet/sec rate increases the amount of time wasted
> as interrupt processing "overhead" becomes significant. For example,
> even a GE interface is capable of doing 1.488 million packets/sec.
>
> By switching to a polling based model, you switch off the interrupt
> generation completely and simply check the NIC for new packets a set
> rate (for example, 1000 times/sec). This gives you a predictable and
> consistent CPU use, so even if you had 1.488M/s interrupts coming in you
> would still only be checking 1000 times/sec. If you did less than
> 1000pps it would be a net increase in CPU, but if you do more (or ever
> risk doing more, such as during a DoS attack) it could be a net benefit.
> This is makes the most sense for people doing a lot of traffic
> regardless.
>
> Of course the downside is higher latency, since you're delaying the
> processing of the packet by some amount of time after it comes in. In
> the 1000 times/sec example above, you could be delaying processing of
> your packet by up to 1ms. For most applications this isn't enough to
> cause any harm, but it's something to keep in mind. Interrupt coalescing
> works around the problem of large interrupt rates by simply having the
> NIC limit the number of interrupts it generates under load, giving you
> the benefits of low-latency processing and low-interrupt rate under high
> load. I haven't played with this stuff in many many years, so I'm sure
> modern interrupt coalescing is much better than it used to be, and the
> extra work of configuring polling and dealing with the potential
> latency/jitter implications isn't worth the benefits for most people. :)
>
> --
> Richard A Steenbergen <ras [at] e-gerbil>       http://www.e-gerbil.net/ras
> GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)
>
>


steve at ibctech

Feb 12, 2010, 5:21 AM

Post #18 of 19 (2584 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

Jack Carrozzo wrote:
> Lots of people roll FreeBSD with Quagga/pf/ipfw for dual stack. See
> the freebsd-isp list.

Raises hand. I do, on these boxes:

http://www.mikrotikrouter.net/

Steve


randy at psg

Feb 12, 2010, 1:51 PM

Post #19 of 19 (2553 views)
Permalink
Re: Linux Router distro's with dual stack capability [In reply to]

> FreeBSD has supported polling for a long time (V6?) and interrupt
> coalescing since some release of V7. (Latest release is V8.)

exactly. and they kick ass

randy

NANOG users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.