I have an ERL running 1.8 that I monitor via PRTG with SNMP. I have 115/115MBps internet service with only IPv4 so I have a VM on my LAN running VyOS running the 6in4 tunnel, This is requiered as the ERL cannot offload 6in4 tunnels and I only have 1 WAN address.
Interface setup like so:
eth0 LAN
eth1 WAN
eth2 IPv6 "WAN"
eth2.14 Public WLAN
With this setup IPv4 from LAN goes stright to WAN, IPv6 Traffic from LAN goes out via eth2 to the VyOS VM which then tunnels via IPv4 on the LAN out to the WAN, so bascily the traffic makes it trough the ERL twice, 1st as IPv6 LAN to eth2 then as IPv4 (v6 tunnel) LAN to WAN.
So downloading via IPv4 WAN -> at 110+Mbps CPU useage 10-14%, But downloading via IPv6 at the same 110+Mbps CPU useage is 60-70% which I would expect should only be doubling to 20-28%.
Attached is a snip of the CPU Graphs from PRTG, 11:05pm - 11:18pm is an IPv6 download max speed, 11:43pm - 11:51pm is an IPv4 download max speed.
Any ideas?
Napsterbater@car1:~$ show ubnt offload IP offload module : loaded IPv4 forwarding: enabled vlan : enabled pppoe : disabled gre : disabled export : disabled dpi : disabled IPv6 forwarding: enabled vlan : enabled pppoe : disabled IPSec offload module: loaded
Napsterbater@car1:~$ show configuration
firewall {
all-ping enable
broadcast-ping disable
group {
address-group WANBlocksv4 {
address 80.192.213.132
description "IPv4 Block at WAN Edge"
}
ipv6-address-group v6PublicServers {
description v6PublicServers
ipv6-address 2001:470:****:1::5
}
ipv6-network-group MyV6Subnets {
description MyV6Subnets
ipv6-network 2001:470:****::/48
ipv6-network 2001:470:****:fc3::/64
ipv6-network 2001:470:****::/48
ipv6-network 2001:470:****:323::/64
}
ipv6-network-group v6LANSubnet {
description v6LAN
ipv6-network 2001:470:****:1::/64
}
ipv6-network-group v6pubLANSubnet {
description v6pubLANSubnet
ipv6-network 2001:470:****:1::/64
}
network-group LAN {
description LAN
network 10.0.1.0/24
}
network-group PubLAN {
description "Public LAN"
network 10.0.2.0/24
}
port-group PubSrvPorts {
port 20-21
port 80
port 443
port 10156-10159
port 10253
port 14501
port 14580-14581
port 1314
port 11000-11100
port 60000-60999
port 8530-8531
port 64738
port 4242
port 3389
port 8333
port 9333
port 32400
}
}
ipv6-name MainIPv6WAN {
default-action drop
rule 1 {
action accept
description "Allow established sessions"
log disable
state {
established enable
related enable
}
}
rule 10 {
action accept
description "TCP/UDP Pub Services"
destination {
group {
ipv6-address-group v6PublicServers
port-group PubSrvPorts
}
}
log disable
protocol tcp_udp
}
rule 15 {
action accept
description "Allow ICMPv6"
log disable
protocol icmpv6
}
}
ipv6-name PubLANBLOCKv6 {
default-action accept
rule 1 {
action accept
description "Public Ipv6 Allow"
destination {
group {
ipv6-address-group v6PublicServers
port-group PubSrvPorts
}
}
log disable
protocol all
}
rule 2 {
action reject
destination {
group {
ipv6-network-group v6LANSubnet
}
}
log disable
protocol all
source {
group {
ipv6-network-group v6pubLANSubnet
}
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name MainWAN {
default-action drop
rule 1 {
action drop
description DNS
destination {
port 53
}
log disable
protocol tcp_udp
}
rule 2 {
action drop
description "IPv4 Block at WAN Edge"
log enable
protocol all
source {
group {
address-group WANBlocksv4
}
}
}
rule 3 {
action accept
description ICMP
log disable
protocol icmp
}
rule 4 {
action accept
description 6in4
log disable
protocol 41
}
rule 5 {
action accept
description "Accept Established"
log disable
protocol all
state {
established enable
invalid disable
new disable
related disable
}
}
rule 6 {
action accept
description "Pub Service Ports Allow"
destination {
group {
port-group PubSrvPorts
}
}
log disable
protocol all
}
rule 7 {
action drop
description "Drop NTP"
destination {
port 123
}
log disable
protocol tcp_udp
}
}
name PubLANBLOCK {
default-action accept
rule 1 {
action accept
description "To 10.0.1.5"
destination {
address 10.0.1.5
group {
port-group PubSrvPorts
}
}
log disable
protocol all
source {
group {
network-group PubLAN
}
}
}
rule 2 {
action reject
description "PubLAN to LAN"
destination {
group {
network-group LAN
}
}
log disable
protocol all
source {
group {
network-group PubLAN
}
}
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
address 10.0.1.3/24
address 2001:470:****:1::3/64
description LAN
dhcpv6-options {
parameters-only
}
duplex auto
firewall {
in {
}
local {
}
out {
}
}
ipv6 {
dup-addr-detect-transmits 1
router-advert {
cur-hop-limit 64
default-lifetime 600
link-mtu 1500
managed-flag true
max-interval 120
name-server 2001:470:****:1::2
name-server 2001:470:****:1::3
other-config-flag true
prefix 2001:470:****:1::/64 {
autonomous-flag true
on-link-flag true
preferred-lifetime 600
valid-lifetime 86400
}
reachable-time 0
retrans-timer 0
send-advert true
}
}
speed auto
}
ethernet eth1 {
address 10.40.0.61/16
description WAN
duplex auto
firewall {
in {
name MainWAN
}
local {
name MainWAN
}
}
mac d0:d0:fd:1a:ca:90
speed auto
}
ethernet eth2 {
address 2001:470:****:fc3::2/64
description "IPv6 WAN"
duplex auto
firewall {
in {
ipv6-name MainIPv6WAN
}
local {
ipv6-name MainIPv6WAN
}
}
speed auto
vif 14 {
address 10.0.2.3/24
address 2001:470:****:2::3/64
description PubLAN
firewall {
in {
ipv6-name PubLANBLOCKv6
name PubLANBLOCK
}
}
ipv6 {
dup-addr-detect-transmits 1
router-advert {
cur-hop-limit 64
default-lifetime 600
link-mtu 1500
managed-flag true
max-interval 120
name-server 2001:470:****:1::2
name-server 2001:470:****:1::3
other-config-flag true
prefix 2001:470:****:2::/64 {
autonomous-flag true
on-link-flag true
preferred-lifetime 600
valid-lifetime 86400
}
reachable-time 0
retrans-timer 0
send-advert true
}
}
}
}
loopback lo {
}
}
port-forward {
auto-firewall enable
hairpin-nat disable
lan-interface eth0
lan-interface eth2.14
rule 1 {
description "11000-11100 Server1"
forward-to {
address 10.0.1.1
}
original-port 11000-11100
protocol tcp_udp
}
rule 2 {
description TVersity
forward-to {
address 10.0.1.1
}
original-port 41952
protocol tcp_udp
}
rule 3 {
description HTTP/S
forward-to {
address 10.0.1.5
}
original-port 80,443,8530,8531,11075-11076
protocol tcp_udp
}
rule 4 {
description FTP
forward-to {
address 10.0.1.5
}
original-port 20-21,11077,60000-60999
protocol tcp_udp
}
rule 5 {
description "TS3 Server"
forward-to {
address 10.0.1.5
}
original-port 9987-9990,30033,10011
protocol tcp_udp
}
rule 6 {
description "APRS-IS Server"
forward-to {
address 10.0.1.2
}
original-port 10156-10159,10253,14501,14580,14581,1314,65000
protocol tcp_udp
}
rule 7 {
description "SoftEther VPN"
forward-to {
address 10.0.1.1
}
original-port 5555
protocol tcp_udp
}
rule 8 {
description "Mumble Server"
forward-to {
address 10.0.1.5
}
original-port 64738
protocol tcp_udp
}
rule 9 {
description RDC
forward-to {
address 10.0.1.1
}
original-port 3389
protocol tcp_udp
}
rule 10 {
description Bitcoin
forward-to {
address 10.0.1.5
}
original-port 8333
protocol tcp
}
rule 11 {
description Litecoin
forward-to {
address 10.0.1.5
}
original-port 9333
protocol tcp
}
rule 12 {
description Plex
forward-to {
address 10.0.1.5
}
original-port 32400
protocol tcp
}
wan-interface eth1
}
protocols {
static {
route 0.0.0.0/0 {
next-hop 10.40.0.1 {
}
}
route6 ::/0 {
next-hop 2001:470:****:fc3::1 {
interface eth2
}
}
}
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LAN {
authoritative disable
subnet 10.0.1.0/24 {
default-router 10.0.1.3
dns-server 10.0.1.2
dns-server 10.0.1.3
domain-name napshome.local
lease 86400
ntp-server 10.0.1.3
start 10.0.1.50 {
stop 10.0.1.240
}
time-server 10.0.1.3
}
}
shared-network-name PubLAN {
authoritative disable
subnet 10.0.2.0/24 {
default-router 10.0.2.3
dns-server 10.0.1.2
dns-server 10.0.2.3
domain-name publan.napshome.local
lease 86400
start 10.0.2.20 {
stop 10.0.2.254
}
}
}
}
dhcpv6-server {
shared-network-name lan {
subnet 2001:470:****:1::/64 {
address-range {
start 2001:470:****:1::1:0 {
stop 2001:470:****:1:ffff:ffff:ffff:ffff
}
}
domain-search napshome.local
lease-time {
default 86400
maximum 86400
minimum 86400
}
name-server 2001:470:****:1::2
name-server 2001:470:****:1::3
sntp-server 2001:470:****:1::3
}
}
shared-network-name publan {
subnet 2001:470:****:2::/64 {
address-range {
start 2001:470:****:2::1:0 {
stop 2001:470:****:2:ffff:ffff:ffff:ffff
}
}
domain-search publan.napshome.local
lease-time {
default 86400
maximum 86400
minimum 86400
}
name-server 2001:470:****:1::2
name-server 2001:470:****:2::3
}
}
}
gui {
https-port 443
listen-address 10.0.1.3
listen-address 2001:470:****:1::3
}
nat {
rule 1 {
description proto41
destination {
}
inbound-interface eth1
inside-address {
address 10.0.1.6
}
log disable
protocol 41
source {
}
type destination
}
rule 5001 {
description "Outbound NAT"
log disable
outbound-interface eth1
protocol all
type masquerade
}
}
snmp {
community napshomesnmpread {
authorization ro
}
contact "****"
location Home
}
ssh {
listen-address 10.0.1.3
port 22
protocol-version v2
}
upnp2 {
acl {
rule 1 {
action deny
description "Block 3074"
external-port 3074
local-port 0-65535
subnet 10.0.1.0/24
}
rule 2 {
action deny
description "Block 3074 pubLAN"
external-port 3074
local-port 0-65535
subnet 10.0.2.0/24
}
rule 3 {
action deny
description "Port 0 Deny"
external-port 0
local-port 0
subnet 10.0.0.0/8
}
}
listen-on eth0
listen-on eth2.14
nat-pmp enable
secure-mode enable
wan eth1
}
}
system {
conntrack {
expect-table-size 8192
hash-size 65536
table-size 262144
tcp {
half-open-connections 512
loose enable
max-retrans 3
}
}
domain-name napshome.local
host-name car1
login {
user Napsterbater {
authentication {
encrypted-password ****************
plaintext-password ****************
}
full-name "Brandon Jackson"
level admin
}
}
name-server 10.0.1.1
name-server 10.0.1.5
ntp {
server 0.us.pool.ntp.org {
}
server 1.us.pool.ntp.org {
}
server 2.us.pool.ntp.org {
}
server 3.us.pool.ntp.org {
}
}
offload {
ipsec enable
ipv4 {
forwarding enable
vlan enable
}
ipv6 {
forwarding enable
vlan enable
}
}
package {
repository wheezy {
components "main contrib non-free"
distribution wheezy
password ****************
url http://http.us.debian.org/debian
username ""
}
repository wheezy-backports {
components "main contrib non-free"
distribution wheezy-backports
password ****************
url http://http.us.debian.org/debian
username ""
}
repository wheezy-security {
components main
distribution wheezy/updates
password ****************
url http://security.debian.org
username ""
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
host 10.0.1.1 {
facility all {
level debug
}
}
}
time-zone America/New_York
traffic-analysis {
dpi disable
export disable
}
}