gmane.comp.security.firewalls.efw.user

Re: Porting the Endian packages on one of themaindistributions

compdoc — 2013-05-06T14:22:58

ClearOS is insanely expensive for any of the features you would want that
match a firewall.

The roles on the website calls itself a network, a gateway, or a server. I
can't really point to it a say exactly what it is. 


------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1

Porting the Endian packages on one of the maindistributions

salihkara — 2013-05-06T12:52:36

Hi Robert,

I appreciate  your work very much, I could set up developer environment,
thanks for your work,

I want to upgrade to Squid 3.1 but there are many dependency issues, I am
wondering if you have ported Endian packages  on one of the main
distributions? If so will you release it? 

By the way I was also checking out ClearOS which uses latest version of
Squid, have you ever thought of using ClearOS instead of Endian?

thanks in advance
 salih



--
View this message in context: http://endian-firewall.1086186.n5.nabble.com/Missing-SRPMs-and-new-Developer-Environment-tp5987p6133.html
Sent from the efw-user mailing list archive at Nabble.com.

------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sf

Content Filter

Herbert Appel — 2013-04-23T07:37:09

Hi to all,

we use EFW in school and run a content filter (at level 50). Of corse a lot of unwanted keywords are forbidden but "Google" is open and the pupils can search for "sex and porn sites" via "google - pictures" :-(

I tried to enter the URL
http://www.google.de/imghp?hl=de&tab=wi
and
http://www.google.de/imghp?hl=de&tab=ii
into the list of forbidden URLs - it didn´t work.

So I remembered the ACL-List for (Cisco-)Routers and created a filter
that is located before the pupils-Filter to close the hole:

Filter 1:
deny http://www.google.de/imghp?hl=de&tab=wi
deny http://www.google.de/imghp?hl=de&tab=ii

Filter 2:
permit all

and not:

Filter 2:
permit all
deny http://www.google.de/imghp?hl=de&tab=wi
deny http://www.google.de/imghp?hl=de&tab=ii

It didn´t work either.

How can I deny porn-pictures or may be all "google-pictures"? Any suggestions?

thanks

Herbert
------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic i

vlan

Andres Gonzalez — 2013-04-22T23:18:42

Hi, I'm trying to setup VLANs on a EFW, what's the "none" option used to?

Thanks.-
------------------------------------------------------------------------------
Precog is a next-generation analytics platform capable of advanced
analytics on semi-structured data. The platform includes APIs for building
apps and a phenomenal toolset for data science. Developers can use
our toolset for easy data analysis & visualization. Get a free account!
http://www2.precog.com/precogplatform/slashdotnewsletter_______________________________________________
Efw-user mailing list
Efw-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
https://lists.sourceforge.net/lists/listinfo/efw-user

Re: Bandwith and Thruput

Farzan Qureshi — 2013-03-21T17:23:04

Glad it is sorted :)

Have a nice day.

Farzan Qureshi
------------------
Rosmini College
Network Administrator & Helpdesk support
 On 22/03/2013 3:16 AM, "Herbert Appel" <postmaster-ryvegzjbgTFyqAhpBLNMxw< at >public.gmane.org> wrote:

Bandwith and Thruput

Herbert Appel — 2013-03-21T14:15:25

Hi,

thanks to all who helped me to solve the problem esp. Josh, Kevin, Andre, Farzan, Davo and all the others.

The solution was the IPS!
I switched it off and ......
53MBit/s up and 13MBit/s down :-)

Now we have no IPS but there are two firewalls in a row 

LAN--------EFW------------FOS 100------FTTH/WAN

thanks a lot

Herbert
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

Re: Bandwidth and Thruput

Farzan Qureshi — 2013-03-21T01:07:52

I agree with you Josh.

On 21 March 2013 13:58, Josh Carter <Josh.Carter-Nv0H9i6MKod1e5UebBYPKRCuuivNXqWP< at >public.gmane.org> wrote:

Re: Bandwidth and Thruput

Josh Carter — 2013-03-21T00:58:05

This is good info here, but something to watch out for:

SKIPMIME image/* video/* audio/*

The above line will PREVENT all images, videos and audio from being scanned for viruses. There are obvious security implications with that, and you should evaluate your security requirements before applying that setting.

From: Farzan Qureshi [mailto:fqureshi-HcX2Z0wcrrZSA5vEwR2GfKVXKuFTiq87< at >public.gmane.org]
Sent: Thursday, 21 March 2013 11:21 AM
To: efw-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
Subject: Re: [Efw-user] Bandwidth and Thruput

Hi Herbert,

I was having similar issues with endian firewall at our end. I have done some modifications to the TCP/IP stack manually and some optimization to dansguardian. It is working very well.

You can try following settings and hopefully this will fix your issues because it did for us. Remember to first reboot your endian firewall and once it is up access it through console and make changes to TCP/IP stack. But let me tell you I still haven't got enough time to

Re: Bandwidth and Thruput

Josh Carter — 2013-03-21T00:08:31

As stated CPU / RAM are your primary concern here. If your CPU usage is high, your throughput will be limited as such. One other consideration for ClamAV is disk speed. The file is downloaded to your EFW disk, scanned by clamav, then passed through to your client. If the disk is slow, that can be a factor.

I have an INTEL atom based EFW running IPS/Proxy/CLAMAV etc and I'm able to fully utilise my 20mbit connection, however I do see ~90% cpu usage and I have an SSD hard drive to improve the 'speed' of clamav. I imagine you would need the newer generation, dual core atom's or a Core i3+ to cope with all the services on a 100/100mbit link.

Hope that's helpful.

From: compdoc [mailto:compdoc-HzkQJFMtZ6VWk0Htik3J/w< at >public.gmane.org]
Sent: Thursday, 21 March 2013 12:43 AM
To: efw-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
Subject: Re: [Efw-user] Bandwidth and Thruput

100baseT = 100 Mbps = 12.5 MBps

EFW depends on the speed of the host cpu and on the network cards. Because of overhead and the lim

Re: Bandwidth and Thruput

Farzan Qureshi — 2013-03-21T00:20:57

Hi Herbert,

I was having similar issues with endian firewall at our end. I have done
some modifications to the TCP/IP stack manually and some optimization to
dansguardian. It is working very well.

You can try following settings and hopefully this will fix your issues
because it did for us. Remember to first reboot your endian firewall and
once it is up access it through console and make changes to TCP/IP stack.
But let me tell you I still haven't got enough time to figure out to make
these changes of TCP/IP permanent. Because it reverts to default settings
on reboot. But for dansguardian those settings are permanent.

I noticed that TTL for established connection is too big by default that is
119:00 something...which is like a connection may live upto 5 days and
hence choke available ports. (you can check this on status and go to
connections)

Following are the instructions for you:

*
TCP/IP Stack Modifications*


Edit:

    nano /proc/sys/net/ipv4/tcp_max_orphans


Change figure to

    8192




Run foll

Re: Bandwidth and Thruput

compdoc — 2013-03-20T13:43:17


 

100baseT = 100 Mbps = 12.5 MBps

 

EFW depends on the speed of the host cpu and on the network cards. Because
of overhead and the limits of older computer buses and cpus, I don't believe
you will get much more than 7MBit/s using 100baseT nics. 

 

I also do not believe 3Com nics are known for their speed.

 

What cpu is in the firewall, and how much ram? These are very important when
processing your enabled services.

 

 

 

 

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar_______________________________________________
Efw-user mailing list
Efw-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
https://lists.sourceforge.net/lists/listinfo/efw-user

Re: Bandwidth and Thruput

Farzan Qureshi — 2013-03-20T08:36:40

Can you please go to status and then connection and tell me what is the
maximum TTL you see on connections? Is it 119:00 ..something? ?

Farzan Qureshi
------------------
Rosmini College
Network Administrator & Helpdesk support
 On 20/03/2013 7:58 PM, "Herbert Appel" <postmaster-ryvegzjbgTFyqAhpBLNMxw< at >public.gmane.org> wrote:

Re: Bandwidth and Thruput

Herbert Appel — 2013-03-20T08:45:53

Hi,

thanks for your hints - I´ll check.

Herbert

Am 20.03.2013 um 09:38 schrieb Andre Mueller:



------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

Re: Bandwidth and Thruput

Herbert Appel — 2013-03-20T08:44:26

Hi,

the NICs are 3COM and Realtec 10/100MBit/s
CPUload is about 80%

I share your opinion but we can´t switch off all services to have max truput :-(
then Endian is useless!

thanks a lot

Herbert

Am 20.03.2013 um 09:35 schrieb kevsworld:


------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar_______________________________________________
Efw-user mailing list
Efw-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
https://lists.sourceforge.net/lists/listinfo/efw-user

Re: Bandwidth and Thruput

Andre Mueller — 2013-03-20T08:38:42

Hello Herbert

If possible I would first try, only for testing purposes, to switch off 
the proxy functionality. Futher I would try to make "measurements" by 
placing a computer in the Red subnet and by transferring large data 
to/from by simple protocol to an other computer in the green subnet. 
Also verifying if the green-interface is really working at 100Mbits and 
not at 10Mbits. Wow is the CPU load? And is /var/log eventually full?

best regards, Andre


Am 20.03.13 09:20, schrieb Herbert Appel:

Re: Bandwidth and Thruput

Herbert Appel — 2013-03-20T08:38:29

Hello Davo,

we used different methods:
1. www.speedtest.net
2. http://www.initiative-netzqualitaet.de
3. Download of a file (e. g. http://www.ibc-blog.de/wp-content/uploads/2012/10/IBC-SOLAR_Jura-Solarpark.jpg) 7MB took 8-9s

greetings
Herbert

Am 20.03.2013 um 09:13 schrieb d.davolio-jhqqPEzQr+OgsXowIWgXJ16hYfS7NtTn< at >public.gmane.org:



------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

Re: Bandwidth and Thruput

kevsworld — 2013-03-20T08:35:13

Hi Herbert

What NIC cards are you using?  I haven't used Endian on a connection as fast as you have but I have noticed a difference between cheap nics and the more expensive server grade ones.  Also I am pretty sure using anti virus scanning is going to affect the throughput. What is your CPU loads showing? 

Regards
Kevin


Sent from Samsung Mobile

-------- Original message --------
From: Herbert Appel <postmaster< at >nx-networx.de> 
Date:  
To: efw-user< at >lists.sourceforge.net 
Subject: Re: [Efw-user] Bandwidth and Thruput 
 
Hello Andre,

hmm - but what could be the reason for that decrease from 50MBit/s --> 7MBit/s?

Herbert
Am 20.03.2013 um 09:10 schrieb Andre Mueller:



------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
Efw-user mailing list
Efw-user< at >lists.sourceforge.ne

Re: Bandwidth and Thruput

2013-03-20T08:13:27

I'm not sure about normality but can you tell how did you measure the 
throughput?
Thanks
Davo

On 03/20/2013 07:40 AM, Herbert Appel wrote:

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

Re: Bandwidth and Thruput

Herbert Appel — 2013-03-20T08:20:26

Hello Andre,

hmm - but what could be the reason for that decrease from 50MBit/s --> 7MBit/s?

Herbert
Am 20.03.2013 um 09:10 schrieb Andre Mueller:



------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

Re: Bandwidth and Thruput

Andre Mueller — 2013-03-20T08:10:39

Hello Herbert

We have FTTH with 50/10Mbits/s (waiting for 100/100) and are running EFW 
2.5.1 Community Version as VM on VMware ESXi 4.1 on an single CPU board 
with Quad Core Xeon L5630 2.13 GHz together with two other Web-Servers 
VM's. Although we do not use any Proxy-functions (CLAVAV, AMAVIS, 
Content-Filter) we have full speed on the Green-interface in 
uploading/downloading towards/from Red-interface and GBit/s speed 
from/toward DMZ Orange-interface. CPU load does never exceed 5% and RAM 
we have assigned 1 GByte (used actually 50%).

with best regards, Andre


Am 20.03.13 07:40, schrieb Herbert Appel:


------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
Efw-user mailing list
Efw-user< at >lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user

Bandwidth and Thruput

Herbert Appel — 2013-03-20T06:40:54

Hello together,

we use the latest version of EFW 2.51 in school.
Since about one week we are connected to FTTH (FOS 100 as CPE) with 50MBit/s.
On the red IF there are truely 50MBit/s, but on the green IF there are only 7MBit/s.
Of course the services decelerate the thruput but I didn´t excpect this decrease.
We are running CLAVAV, AMAVIS, NTP, DHCP, Content-Filter.
What bothers me is that,when we were connected to DSL with 368kBit/s, we had full speed on the green side (47kB/s).

Can somebody confirm that this is normal?
Or, what can we do to lever the thruput?

I would be grateful for any hint.
Thanks in advance

Herbert
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar