Bug with netfilter and NFS server on same machine

I have been experiencing problems running a nfs server and iptables on the same machine.The problem was also reported almost a year ago by Paul Raines on the netfilter mailing list http://lists.netfilter.org/pipermail/netfilter/2002-January/030002.html but it seems no solution has been found yet.

The problem is this: A machine running linux 2.4.18 or 2.4.19 works just fine when running just the kernel nfsd. A single client connected to the server with 100Mbit ethernet sees throughput of 5-10MByte/sec even after an hour or two of continous transfers. If the nfs server is also running iptables the throughput is initially the same (5-10MByte/sec) but after a while (200MByte-500MByte total transfer) the client starts reporting "nfs server not responding" followed after a while by "nfs server OK" and of course the transfer rate goes way down (< 1MByte/sec). Using tcpdump on the client seems to indicate that some packets have their headers garbled - wrong fragment ids being the typical error.

Having iptables compiled as modules and simply loading or unloading the ipt_conntrack module is sufficient for causing/removing the problem. Having iptables support compiled into the kernel causes the problem allways.

The problem has been verified on 4 different machines with a variety of different ethernet cards. In
all cases the network continues to work without problems for all other types of traffic - i.e a telnet connection from client to server works with no delay and a ftp transfer goes at >5MByte/sec even when nfs throughput is suffering.

\Lars Knudsen

Am Sam, 2002-11-23 um 19.37 schrieb Lars Knudsen:

Linux nicole 2.4.19-586tsc #1 Sun Oct 6 18:00:21 EST 2002 i586 unknown unknown GNU/Linux

egger@nicole:~$ sudo lsmod
Module                  Size  Used by    Not tainted
ipt_TOS                 1016  12  (autoclean)
ipt_MASQUERADE          1176   1  (autoclean)
ipt_REDIRECT             728   1  (autoclean)
ipt_REJECT              2776   4  (autoclean)
ipt_LOG                 3160   6  (autoclean)
ipt_state                568  55  (autoclean)
iptable_mangle          2100   1  (autoclean)
ip_nat_irc              2288   0  (unused)
ip_nat_ftp              2960   0  (unused)
iptable_nat            13208   3  [ipt_MASQUERADE ipt_REDIRECT ip_nat_irc ip_nat_ftp]
ip_conntrack_irc        2464   0  (unused)
ip_conntrack_ftp        3200   0  (unused)
ip_conntrack           13148   4  [ipt_MASQUERADE ipt_REDIRECT ipt_state ip_nat_irc ip_nat_ftp iptable_nat ip_conntrack_irc ip_conntrack_ftp]
iptable_filter          1672   1  (autoclean)
ip_tables              10488  11  [ipt_TOS ipt_MASQUERADE ipt_REDIRECT ipt_REJECT ipt_LOG ipt_state iptable_mangle iptable_nat iptable_filter]
nfsd                   65616   5  (autoclean)
lockd                  46864   1  (autoclean) [nfsd]
sunrpc                 57436   1  (autoclean) [nfsd lockd]
af_packet              11656   1  (autoclean)

00:12.0 Ethernet controller: D-Link System Inc Sundance Ethernet
Subsystem: D-Link System Inc Sundance Ethernet
Flags: bus master, medium devsel, latency 64, IRQ 5 I/O ports at d800 [size=128]
Memory at e2810000 (32-bit, non-prefetchable) [size=128] Expansion ROM at e1000000 [disabled] [size=64K]
Capabilities: <available only to root>

No problems with NFS whatsoever. Gigabytes of traffic get from or to this machine without any lag. The firewall is rather restricted to the inside and NFS nailed to fixed ports.

Servus,
       Daniel