Network overhead when using a sys-firewall between AppVM and vpn qube

User Support
1

Hi,

Disclaimer: this is a rather technical topic network related.

I’ve been using a netvm for a wireguard VPN for a while, it’s working fine, now I wanted to add a firewall qube between the qubes and the vpn qube, but this drastically reduce the available bandwidth over the VPN.

I have a slow ADSL connection with a maximum upload of 100 kB/s, when using the VPN directly, I can fill the download bandwidth without reaching my upload limit.

When adding a qube firewall, it almost double the bandwidth used for uploading packets (like if it added fragmentation maybe?) and so it reduces my download bandwidth as it’s capped by the upload…

Some metrics

Download speed over the VPN : solid 1 MB/s results in a physical interface upload of 43 kB/s
Download speed over the VPN with extra firewall : barely 1 MB/s results in a physical interface upload of 100 kB/s

Not sure if it’s clear? :sweat_smile:

2

You can try to check the traffic with wireshark.

3

Could it be that a header somewhere is causing the mtu to be overhelmed after the vpn? (and leads to flow fragmentation).

4

It could be possible if sys-firewall is blocking ICMP.

5

I didn’t had any special rules, I just created a disposable qube with netvm enabled, and put it between the vpn and the qube using the vpn :woman_shrugging:

6

yeah, I’ll have to do that :sweat_smile: at least to check for fragmentation

1 Like