tcp tuning for pfsense?

[JJB]

http://www.psc.edu/networking/projects/tcptune/

I'm wondering if any of this freebsd tuning info is relevant to pfsense,
has it already been done, are there any benefits to setting any of
these things (some of which are missing - there seems to be no
/etc/rc.conf on pfsense - where is it?).


Procedure for raising network limits under FreeBSD

All system parameters can be read or set with 'sysctl'. E.g.:

sysctl [parameter]
sysctl -w [parameter]=[value]

You can raise the maximum socket buffer size by, for example:

sysctl -w kern.ipc.maxsockbuf=4000000

You can also set the TCP and UDP default buffer sizes using the variables

net.inet.tcp.sendspace
net.inet.tcp.recvspace
net.inet.udp.recvspace

When using larger socket buffers, you probably need to make sure that
the TCP window scaling option is enabled. (The default is not enabled!)
Check 'tcp_extensions="YES"' in /etc/rc.conf and ensure it's enabled via
the sysctl variable:

net.inet.tcp.rfc1323

FreeBSD's TCP has a thing called "inflight limiting" turned on by
default, which can be detrimental to TCP throughput in some situations.
If you want "normal" TCP behavior you should

sysctl -w net.inet.tcp.inflight_enable=0

You may also want to confirm that SACK is enabled: (working since
FreeBSD 5.3):

net.inet.tcp.sack.enable

MTU discovery is on by default in FreeBSD. If you wish to disable MTU
discovery, you can toggle it with the sysctl variable:

net.inet.tcp.path_mtu_discovery

Contributors: Pekka Savola and David Malone.
/Checked for FreeBSD 5.3, May 2006/

[Chris Buechler]

Post by JJB
http://www.psc.edu/networking/projects/tcptune/
I'm wondering if any of this freebsd tuning info is relevant to
pfsense, has it already been done, are there any benefits to setting
any of these things

Don't bother, these things are all only relevant to the endpoints of TCP
connections. Your firewall has no relation to things like SACK,
inflight, PMTUD, etc. that's all solely machines on the client and
server end of the connections.

If you use packages that initiate connections from the firewall itself,
like squid, then some might be relevant. For most deployments, don't touch.

[Paul Mansfield]

Post by JJB
http://www.psc.edu/networking/projects/tcptune/

tcp auto-tuning has been in the linux kernel for quite a while, so
unless you have lots of time to test things, chances are tweaking your
linux box will only make it worse

and as Chris B says, it's largely irrelevant to pfSense - this was
covered in a thread a while back, so if you're still interested search
the mail list archives.

[Espen Johansen]

For the record, pfSense is not linux but freebsd.

-lsf

On Fri, Oct 24, 2008 at 1:55 PM, Paul Mansfield

Post by Paul Mansfield

Post by JJB
http://www.psc.edu/networking/projects/tcptune/

tcp auto-tuning has been in the linux kernel for quite a while, so
unless you have lots of time to test things, chances are tweaking your
linux box will only make it worse
and as Chris B says, it's largely irrelevant to pfSense - this was
covered in a thread a while back, so if you're still interested search
the mail list archives.
---------------------------------------------------------------------