SMB over IPSEC...

[Tim Nelson]

Hello fellow monowallers... I know the issue of SMB/Samba/Netbios over IPSEC has come up many times. However, the issue always seems to be related to the fact that broadcasts are not being passed over the IPSEC tunnel. I'm currently trying to use Samba over IPSEC(one site has monowall 1.3b11 and the other has pfSense 1.2-RELEASE) but instead of relying on broadcasting and using 'Network Neighborhood' to find the Samba boxes, we're accessing them directly via IP address by entering "\\192.168.1.100" in the address bar of the clients which are primarily WinXP machines. They are able to find the server and access it's shares but opening a file... even small ones like 20k... takes FOREVER. I'm wondering if there isn't a different issue such as fragmentation happening. Both sides of the tunnel have completely open "Allow any to any from any" rules so firewalling should not be the issue. Has anyone seen this type of behavior before? I can make my logs available but after looking through them, I'm not seeing anything of consequence. All help is welcome and appreciated. Thank you!

Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105

[mtnbkr]

- gpg control packet
Tim Nelson wrote:
| Hello fellow monowallers... I know the issue of SMB/Samba/Netbios over IPSEC
has come up many times. However, the issue always seems to be related to the
fact that broadcasts are not being passed over the IPSEC tunnel. I'm currently
trying to use Samba over IPSEC(one site has monowall 1.3b11 and the other has
pfSense 1.2-RELEASE) but instead of relying on broadcasting and using 'Network
Neighborhood' to find the Samba boxes, we're accessing them directly via IP
address by entering "\\192.168.1.100" in the address bar of the clients which
are primarily WinXP machines. They are able to find the server and access it's
shares but opening a file... even small ones like 20k... takes FOREVER. I'm
wondering if there isn't a different issue such as fragmentation happening.
Both sides of the tunnel have completely open "Allow any to any from any"
rules so firewalling should not be the issue. Has anyone seen this type of
behavior before? I can make my logs available but after looking through them,
I'm not seeing anything of consequence. All help is welcome and appreciated.
Thank you!

Hi Tim,

I can't comment on the speed issues you refer to, but if you give your windows
machines the address(es) of your WINS server(s) in the m0n0wall DHCP setup
page, then they will be able to "browse" the "network neighborhood" and access
machines by name instead of only IP - even across subnets.

--
Bill Arlofski
Reverse Polarity, LLC
http://www.revpol.com/

[Tim Nelson]

Thank you for the quick reply Bill. The issue of using hostnames across the tunnel is secondary to the speed issue but appreciated nonetheless. When our performance issues have been sorted out, I'll be sure to look at implementing WINS to make it easier on the "monkeys". :-)

Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105

----- Original Message -----
From: "mtnbkr" <waa-***@revpol.com>
Cc: ***@lists.m0n0.ch
Sent: Wednesday, July 23, 2008 9:20:57 AM GMT -06:00 US/Canada Central
Subject: Re: [m0n0wall] SMB over IPSEC...

- gpg control packet
Tim Nelson wrote:
| Hello fellow monowallers... I know the issue of SMB/Samba/Netbios over IPSEC
has come up many times. However, the issue always seems to be related to the
fact that broadcasts are not being passed over the IPSEC tunnel. I'm currently
trying to use Samba over IPSEC(one site has monowall 1.3b11 and the other has
pfSense 1.2-RELEASE) but instead of relying on broadcasting and using 'Network
Neighborhood' to find the Samba boxes, we're accessing them directly via IP
address by entering "\\192.168.1.100" in the address bar of the clients which
are primarily WinXP machines. They are able to find the server and access it's
shares but opening a file... even small ones like 20k... takes FOREVER. I'm
wondering if there isn't a different issue such as fragmentation happening.
Both sides of the tunnel have completely open "Allow any to any from any"
rules so firewalling should not be the issue. Has anyone seen this type of
behavior before? I can make my logs available but after looking through them,
I'm not seeing anything of consequence. All help is welcome and appreciated.
Thank you!

Hi Tim,

I can't comment on the speed issues you refer to, but if you give your windows
machines the address(es) of your WINS server(s) in the m0n0wall DHCP setup
page, then they will be able to "browse" the "network neighborhood" and access
machines by name instead of only IP - even across subnets.

--
Bill Arlofski
Reverse Polarity, LLC
http://www.revpol.com/

---------------------------------------------------------------------
To unsubscribe, e-mail: m0n0wall-***@lists.m0n0.ch
For additional commands, e-mail: m0n0wall-***@lists.m0n0.ch

[Lee Sharp]

Post by Tim Nelson
They are able to find the server and access it's shares but opening a file... even small ones like 20k... takes FOREVER.

Sniff the link... SMB is a noisy and inefficient protocol. You fixed
the name resolution, which is a problem for Windows on any routed
network, but you can't fix the bandwidth.

Lee

[Mark Rinaudo]

Tim,

I had a similar issue a couple of years ago with an ipsec tunnel between my
m0n0wall and a netgear router. The tunnel would come and I could browse a
windows 2003 server's folders but dealing at the file level was slow and
writing files was impossible. Finally tracked it down to the MTU size of
packets being sent from the windows machines. Try adjusting the MTU size of
your packets and see if that helps.

Mark
Preferred Data Solutions
318-550-3381

----- Original Message -----
From: "Tim Nelson" <***@rockbochs.com>
To: <***@lists.m0n0.ch>
Sent: Wednesday, July 23, 2008 9:07 AM
Subject: [m0n0wall] SMB over IPSEC...


Hello fellow monowallers... I know the issue of SMB/Samba/Netbios over IPSEC
has come up many times. However, the issue always seems to be related to the
fact that broadcasts are not being passed over the IPSEC tunnel. I'm
currently trying to use Samba over IPSEC(one site has monowall 1.3b11 and
the other has pfSense 1.2-RELEASE) but instead of relying on broadcasting
and using 'Network Neighborhood' to find the Samba boxes, we're accessing
them directly via IP address by entering "\\192.168.1.100" in the address
bar of the clients which are primarily WinXP machines. They are able to find
the server and access it's shares but opening a file... even small ones like
20k... takes FOREVER. I'm wondering if there isn't a different issue such as
fragmentation happening. Both sides of the tunnel have completely open
"Allow any to any from any" rules so firewalling should not be the issue.
Has anyone seen this type of behavior before? I can make my logs available
but after looking through them, I'm not seeing anything of consequence. All
help is welcome and appreciated. Thank you!

Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105

---------------------------------------------------------------------
To unsubscribe, e-mail: m0n0wall-***@lists.m0n0.ch
For additional commands, e-mail: m0n0wall-***@lists.m0n0.ch

[Tim Nelson]

Did you adjust the MTU for a particular interface on the firewall or on the clients directly? Or, is it possible to change the MTU of the IPSEC tunnel itself?

I'm seeing some improved performance by enabling "Clear DF bit instead of dropping" on the pfsense side as well as "Allow IPsec fragmented packets" on the monowall side. It appears that fragmentation/MTU is the likely culprit...

Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105

----- Original Message -----
From: "Mark Rinaudo" <***@preferreddatasolutions.com>
To: ***@lists.m0n0.ch
Sent: Wednesday, July 23, 2008 9:45:45 AM GMT -06:00 US/Canada Central
Subject: Re: [m0n0wall] SMB over IPSEC...

Tim,

I had a similar issue a couple of years ago with an ipsec tunnel between my
m0n0wall and a netgear router. The tunnel would come and I could browse a
windows 2003 server's folders but dealing at the file level was slow and
writing files was impossible. Finally tracked it down to the MTU size of
packets being sent from the windows machines. Try adjusting the MTU size of
your packets and see if that helps.

Mark
Preferred Data Solutions
318-550-3381

----- Original Message -----
From: "Tim Nelson" <***@rockbochs.com>
To: <***@lists.m0n0.ch>
Sent: Wednesday, July 23, 2008 9:07 AM
Subject: [m0n0wall] SMB over IPSEC...


Hello fellow monowallers... I know the issue of SMB/Samba/Netbios over IPSEC
has come up many times. However, the issue always seems to be related to the
fact that broadcasts are not being passed over the IPSEC tunnel. I'm
currently trying to use Samba over IPSEC(one site has monowall 1.3b11 and
the other has pfSense 1.2-RELEASE) but instead of relying on broadcasting
and using 'Network Neighborhood' to find the Samba boxes, we're accessing
them directly via IP address by entering "\\192.168.1.100" in the address
bar of the clients which are primarily WinXP machines. They are able to find
the server and access it's shares but opening a file... even small ones like
20k... takes FOREVER. I'm wondering if there isn't a different issue such as
fragmentation happening. Both sides of the tunnel have completely open
"Allow any to any from any" rules so firewalling should not be the issue.
Has anyone seen this type of behavior before? I can make my logs available
but after looking through them, I'm not seeing anything of consequence. All
help is welcome and appreciated. Thank you!

Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105

---------------------------------------------------------------------
To unsubscribe, e-mail: m0n0wall-***@lists.m0n0.ch
For additional commands, e-mail: m0n0wall-***@lists.m0n0.ch



---------------------------------------------------------------------
To unsubscribe, e-mail: m0n0wall-***@lists.m0n0.ch
For additional commands, e-mail: m0n0wall-***@lists.m0n0.ch

[Mark Rinaudo]

Tim,

I adjusted the MTU size in the registry on the Winblows 2003 server. Not
sure about adjusting the MTU size of the IPSEC tunnel.

Mark

----- Original Message -----
From: "Tim Nelson" <***@rockbochs.com>
To: <***@lists.m0n0.ch>
Sent: Wednesday, July 23, 2008 9:52 AM
Subject: Re: [m0n0wall] SMB over IPSEC...

Post by Tim Nelson
Did you adjust the MTU for a particular interface on the firewall or on
the clients directly? Or, is it possible to change the MTU of the IPSEC
tunnel itself?
I'm seeing some improved performance by enabling "Clear DF bit instead of
dropping" on the pfsense side as well as "Allow IPsec fragmented packets"
on the monowall side. It appears that fragmentation/MTU is the likely
culprit...
Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105
----- Original Message -----
Sent: Wednesday, July 23, 2008 9:45:45 AM GMT -06:00 US/Canada Central
Subject: Re: [m0n0wall] SMB over IPSEC...
Tim,
I had a similar issue a couple of years ago with an ipsec tunnel between my
m0n0wall and a netgear router. The tunnel would come and I could browse a
windows 2003 server's folders but dealing at the file level was slow and
writing files was impossible. Finally tracked it down to the MTU size of
packets being sent from the windows machines. Try adjusting the MTU size of
your packets and see if that helps.
Mark
Preferred Data Solutions
318-550-3381
----- Original Message -----
Sent: Wednesday, July 23, 2008 9:07 AM
Subject: [m0n0wall] SMB over IPSEC...
Hello fellow monowallers... I know the issue of SMB/Samba/Netbios over IPSEC
has come up many times. However, the issue always seems to be related to the
fact that broadcasts are not being passed over the IPSEC tunnel. I'm
currently trying to use Samba over IPSEC(one site has monowall 1.3b11 and
the other has pfSense 1.2-RELEASE) but instead of relying on broadcasting
and using 'Network Neighborhood' to find the Samba boxes, we're accessing
them directly via IP address by entering "\\192.168.1.100" in the address
bar of the clients which are primarily WinXP machines. They are able to find
the server and access it's shares but opening a file... even small ones like
20k... takes FOREVER. I'm wondering if there isn't a different issue such as
fragmentation happening. Both sides of the tunnel have completely open
"Allow any to any from any" rules so firewalling should not be the issue.
Has anyone seen this type of behavior before? I can make my logs available
but after looking through them, I'm not seeing anything of consequence. All
help is welcome and appreciated. Thank you!
Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105
---------------------------------------------------------------------
---------------------------------------------------------------------
---------------------------------------------------------------------

[Tim Nelson]

Actual bandwidth between sites is very good at about 1mbit and latency is around 100ms. FTP traffic through the IPSEC tunnel hits at least 700k or so...

Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105

----- Original Message -----
From: "Lee Sharp" <***@hal-pc.org>
To: ***@lists.m0n0.ch
Sent: Wednesday, July 23, 2008 9:32:27 AM GMT -06:00 US/Canada Central
Subject: Re: [m0n0wall] SMB over IPSEC...

Post by Tim Nelson
They are able to find the server and access it's shares but opening a file... even small ones like 20k... takes FOREVER.

Sniff the link... SMB is a noisy and inefficient protocol. You fixed
the name resolution, which is a problem for Windows on any routed
network, but you can't fix the bandwidth.

Lee

---------------------------------------------------------------------
To unsubscribe, e-mail: m0n0wall-***@lists.m0n0.ch
For additional commands, e-mail: m0n0wall-***@lists.m0n0.ch

[Lee Sharp]

Post by Tim Nelson
Actual bandwidth between sites is very good at about 1mbit and latency is around 100ms. FTP traffic through the IPSEC tunnel hits at least 700k or so...

Seriously, sniff that link. The latency is killing you are SMB has way
too much crosstalk. And yes, the MTU thing can help, but the crosstalk
will still kill you.

Lee

[Tim Nelson]

I'll sniff it and see what we turn up... Thank you for your help!

Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105

----- Original Message -----
From: "Lee Sharp" <***@hal-pc.org>
To: ***@lists.m0n0.ch
Sent: Wednesday, July 23, 2008 10:03:06 AM GMT -06:00 US/Canada Central
Subject: Re: [m0n0wall] SMB over IPSEC...

Post by Tim Nelson
Actual bandwidth between sites is very good at about 1mbit and latency is around 100ms. FTP traffic through the IPSEC tunnel hits at least 700k or so...

Seriously, sniff that link. The latency is killing you are SMB has way
too much crosstalk. And yes, the MTU thing can help, but the crosstalk
will still kill you.

Lee

---------------------------------------------------------------------
To unsubscribe, e-mail: m0n0wall-***@lists.m0n0.ch
For additional commands, e-mail: m0n0wall-***@lists.m0n0.ch

[Chris Buechler]

Post by Tim Nelson
Actual bandwidth between sites is very good at about 1mbit and latency is around 100ms. FTP traffic through the IPSEC tunnel hits at least 700k or so...

It's all about latency, bandwidth is largely irrelevant as long as you
have broadband on both ends. 100ms is high.

Try dropping MTU on client and server machines and see what happens.
That might improve things, but you will never see good SMB performance
at 100 ms latency. At least what I would consider good, which would be
near LAN performance.

-Chris

[Tim Nelson]

I just can't believe that with all the improvements and new developments in the network world that someone hasn't come up with a broadband technology that can be run over tin cans and string yet still have 1-2ms of latency!!!

Seriously though... I can see the latency being a huge issue here. I just did a constant ping and the latency is varying between 90ms and 240ms... ouch. I'll continue to do some tweaking. Thank you all for the great ideas and assistance!

Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105

----- Original Message -----
From: "Chris Buechler" <***@gmail.com>
To: "monowall" <***@lists.m0n0.ch>
Sent: Wednesday, July 23, 2008 10:06:24 AM GMT -06:00 US/Canada Central
Subject: Re: [m0n0wall] SMB over IPSEC...

Post by Tim Nelson
Actual bandwidth between sites is very good at about 1mbit and latency is around 100ms. FTP traffic through the IPSEC tunnel hits at least 700k or so...

It's all about latency, bandwidth is largely irrelevant as long as you
have broadband on both ends. 100ms is high.

Try dropping MTU on client and server machines and see what happens.
That might improve things, but you will never see good SMB performance
at 100 ms latency. At least what I would consider good, which would be
near LAN performance.

-Chris

---------------------------------------------------------------------
To unsubscribe, e-mail: m0n0wall-***@lists.m0n0.ch
For additional commands, e-mail: m0n0wall-***@lists.m0n0.ch

[Chris Buechler]

Post by Tim Nelson
I just can't believe that with all the improvements and new developments in the network world that someone hasn't come up with a broadband technology that can be run over tin cans and string yet still have 1-2ms of latency!!!

Dang physics and that pesky speed of light. ;)

Post by Tim Nelson
Seriously though... I can see the latency being a huge issue here. I just did a constant ping and the latency is varying between 90ms and 240ms... ouch. I'll continue to do some tweaking. Thank you all for the great ideas and assistance!

Ouch! Yeah there you go, that's going to have a very serious impact.
I'd see why it is that it's that terrible, are the upstream or
downstream on either side getting maxed out, or is it just a poor
connection between the two otherwise fine Internet connections.

-Chris

[Chris Buechler]

Post by Tim Nelson
Hello fellow monowallers... I know the issue of SMB/Samba/Netbios over IPSEC has come up many times. However, the issue always seems to be related to the fact that broadcasts are not being passed over the IPSEC tunnel. I'm currently trying to use Samba over IPSEC(one site has monowall 1.3b11 and the other has pfSense 1.2-RELEASE) but instead of relying on broadcasting and using 'Network Neighborhood' to find the Samba boxes, we're accessing them directly via IP address by entering "\\192.168.1.100" in the address bar of the clients which are primarily WinXP machines. They are able to find the server and access it's shares but opening a file... even small ones like 20k... takes FOREVER. I'm wondering if there isn't a different issue such as fragmentation happening. Both sides of the tunnel have completely open "Allow any to any from any" rules so firewalling should not be the issue. Has anyone seen this type of behavior before? I can make my logs available but after looking through them, I'm not seeing anything of consequence. All help is welcome and appreciated. Thank you!

What is the end to end latency over the VPN? SMB (v1) is *very*
sensitive to latency, it's normal for anything with 60-70+ ms latency
to run pathetically. Anything over 30-40 ms is slow, you need under 10
ms latency for LAN level experiences with SMB. SMB makes an inordinate
amount of round trips to do something as silly as opening a single
file or getting a directory listing. Unless you have two connections
on the same ISP in the same city there isn't any chance you'll have an
Internet VPN at under 10 ms.

The "good" news is Vista and Server 2008 support SMB v2 which combines
multiple requests into a single request, greatly reducing the dozens
to hundreds of requests. One of the major reasons for this change is
to address the previously mentioned performance problem over higher
latency connections. SMB v2 is only used when connecting from Vista or
2008 to another Vista or 2008 machine, it uses v1 when communicating
with previous Windows versions.

So...ready to upgrade everything to Vista and Server 2008? ;)

There is a chance some larger packets could be getting black holed and
really exacerbating the normal issues with high latency and SMB, might
want to try dropping MTU on a couple systems to 1400 and see if that
changes anything.

-Chris

[Tim Nelson]

I think the large variance in latency is due to some of the other services at one location randomly choking the connection(video conferencing...). Time to look at shaping again...

Tim Nelson
Systems/Network Support
Rockbochs Inc.
[phone] x105

----- Original Message -----
From: "Chris Buechler" <***@gmail.com>
Cc: "m0n0wall" <***@lists.m0n0.ch>
Sent: Wednesday, July 23, 2008 10:20:17 AM GMT -06:00 US/Canada Central
Subject: Re: [m0n0wall] SMB over IPSEC...

Post by Tim Nelson
I just can't believe that with all the improvements and new developments in the network world that someone hasn't come up with a broadband technology that can be run over tin cans and string yet still have 1-2ms of latency!!!

Dang physics and that pesky speed of light. ;)

Post by Tim Nelson
Seriously though... I can see the latency being a huge issue here. I just did a constant ping and the latency is varying between 90ms and 240ms... ouch. I'll continue to do some tweaking. Thank you all for the great ideas and assistance!

Ouch! Yeah there you go, that's going to have a very serious impact.
I'd see why it is that it's that terrible, are the upstream or
downstream on either side getting maxed out, or is it just a poor
connection between the two otherwise fine Internet connections.

-Chris

---------------------------------------------------------------------
To unsubscribe, e-mail: m0n0wall-***@lists.m0n0.ch
For additional commands, e-mail: m0n0wall-***@lists.m0n0.ch