pfSense ku-Virtio: i-TCP iyama kuze kucishwe i-offload

Iklayenti libika ukuthi i-tunnel iyaxhuma, i-ping iyaphendula, ikhasi lokungena liyalayisha, bese ukudluliswa kuma endaweni efanayo kuwo wonke umzamo. Lelo phatheni selivele lisho okuningi: ukufinyelela kuyasebenza kodwa umthamo oqhubekayo awusebenzi. Ngaphambi kokuvula i-firewall, thola ukuthi i-VPN ihlanganyela nhlobo yini kule nkinga. Dlulisa i-TCP enkulu nge-gateway efanayo ngaphandle kwe-tunnel endleleni; uma nayo ima, i-OpenVPN ayizange ihlanganyele.

Isivakashi se-pfSense esisebenzisa ikhadi lenethiwekhi le-virtio sinesizathu esihle kakhulu sokwehluleka ngendlela efanayo.

Amaphakethe amancane ayadlula, i-TCP enkulu iyalenga

Ukuxhawula, izimpendulo ze-DNS kanye nomsindo we-ICMP kuncane futhi ngokuvamile kuyadlula. Ukudluliswa okuqhubekayo kuphoqa isivakashi ukuthi sihlukanise, futhi yilapho kuvela khona indlela ye-offload eyonakele. Iphutha akudingeki libe lingalingani: ithrafikhi ephumayo ingase ihlanze ngenkathi engenayo iwa, noma okuphambene, ngakho umsebenzisi angangena bese ema empendulweni yokuqala enkulu. Njengoba iklayenti elifanayo lisebenza nge-gateway enye, ingxenye entsha kakhulu ithola icala.

Ngakho hlola i-gateway ngaphandle kwe-tunnel. Ukulandwa kusuka ku-LAN kuya ku-WAN okukhulu ngokwanele ukusebenza imizuzwana embalwa kwanele, futhi kufanele kwenziwe ngaphambi kwanoma yiluphi ushintsho lwezilungiselelo ukuze ukuqhathanisa kwamuva kube nomqondo.

Yini i-offload eyithembisa ngempela

I-virtio iyi-paravirtual: umsingathi nesivakashi bayabelana ngomsebenzi, umsingathi umemezela amandla e-checksum nokuhlukanisa futhi ulindele ukuthi isivakashi siqedele lokho esikuqalile. Uma isitaki sesivakashi singakwenzi lokho, amafreyimu aphuma nama-checksum anganele noma umsingathi uwalahla. I-E1000 elingisiwe inikeza imodeli elula futhi enensayo lapho inkinga inyamalala ngaphandle koshintsho olulodwa ku-pfSense. Ukuxoxisana ngamandla kwenzeka ngedivayisi ngayinye, okuchaza ukuthi kungani isivakashi esisodwa sisebenza izinyanga ngenkathi iwele laso elakhiwe kabusha lihluleka ngosuku lokuqala.

Isethi okuxoxiswene ngayo incike kunguqulo ye-hypervisor kanye nemodeli yekhadi lenethiwekhi ekhethiwe, hhayi kuphela kukho ukucushwa okulethe.

Ibhokisi elilodwa lokukhetha ligcina i-virtio

Kusixhumi se-pfSense, iSistimu bese kuba yiThuthukisiwe bese kuba yiNethiwekhi kuqukethe ibhokisi lokukhetha elibizwa ngokuthi Khubaza i-offload ye-checksum yehadiwe. Uma ulikha, isivakashi sibala ama-checksum kusofthiwe, okuhambisana nalokho isitaki se-FreeBSD ngemuva kwe-pfSense esikulindele kudivayisi ye-paravirtual. Izinketho ezimbili ezihlobene ekhasini elifanayo zihlanganisa i-offload yokuhlukanisa i-TCP yehadiwe kanye ne-offload yokwamukela okukhulu kwehadiwe. Phendukela kuzo uma ukuxhawula kuphumelela kodwa ukudluliswa okukhulu kungaphumeleli.

Shiya ikhadi lenethiwekhi liyi-virtio ngenkathi wenza ushintsho. Ukushintshela ku-E1000 kushisa i-CPU kuwo wonke amaphakethe isikhathi sokuphila kwe-VM futhi kufihla inkinga yokucushwa kunoma ubani ozothola umsingathi njengefa, okuwukuhweba okubi kakhulu kunendlela yedatha enensayo kancane kodwa ebikezelwayo.

Linganisa izindleko osanda kuzamukela

I-checksum yesofthiwe ihambisa umsebenzi ngaphakathi kwisivakashi, ngakho linganisa umthamo kamuva esikhundleni sokucabanga ukuthi awubizi lutho. Ku-VM encane isijeziso singokoqobo, kodwa siyabonakala futhi sizinzile, ngokungafani nokulahleka okuthule. Qhathanisa izibali zamaphutha zesixhumi kanye nelogi ye-kernel yesivakashi ngaphambi nangemuva. I-hypervisor ehlunga ibhuloho iyiphutha elihlukile elinobufakazi obuhlukile, futhi ayikho ifulegi ye-offload ezolilapha.

Shintsha into eyodwa ngokuhlola ngakunye bese ubhala indlela yemenyu, ibhokisi olikhethile kanye nenombolo oyilinganisile. Noma ubani ozobhekana nesivakashi esilandelayo esakhiwe kabusha uzofuna zontathu.

Amanye ama-firewall ase-BSD anikeza ukulawula okulinganayo kuzilungiselelo zawo zesixhumi, ngakho ukucabanga kuyahamba ngisho uma indlela yemenyu ingahambi.