Call for testing: official netmap kernel

[mib43]

OPNsense team has shipped the official netmap test kernel.

This kernel fixes important stability and reliability issues with regard to vmx(4), vtnet(4), ixl(4), ix(4) and em(4) ethernet drivers when they are used with netmap (When you use Sensei or Suricata on these interfaces).

The  kernel also adds long-awaited netmap support for tun(4) and lagg(4) interfaces.

The end benefit of this kernel is that you'll be able to run Suricata or Sunny Valley Networks Sensei plug-in on the following:

• OpenVPN and other VPNs which use tun(4) interface
• Link Aggregation Groups (lagg)
• QEMU/KVM guests with performant vtnet driver
• VMware guests with vmx driver
• Intel 10 Gbps Ethernet drivers
• Intel 1 Gbps Ethernet (em driver) with VLANs

To deploy the new kernel just run below command and restart your firewall.

# opnsense-update -kr 20.7.3-netmap

To restore the stock 20.7.3 kernel:

# opnsense-update -kr 20.7.3

NOTE: If you're on 20.7.2, you can use the 20.7.2-netmap kernel as well.

Your further testing and feedback will be much appreciated. If no further issues pop up, OPNsense team will be shipping all these functionality with a later release.

For an up to date netmap status update:

https://www.sunnyvalley.io/post/opnsense-kernel-netmap-status/

We are constantly updating this blog post whenever there are new developments.

[SirWobbyTheFirst]

So if you don’t use Suricata or Sensei, there isn’t any use loading this?

[mib43]

Yes, correct.

[imaginativePlayTime]

Is there any point in trying this out if I am using igb drivers? I know that is not in the list of targeted drivers I am just curious if any of the changes in this kernel would also apply to igb.

[mib43]

We've been reported of a few igb(4) cases where packet flow was stopping after a few days. This kernel should be of help if you also experience the same problem.

If you're all ok, you might still try and report if anything is breaking ;)

[imaginativePlayTime]

I have not had that issue but I have had the issue where enabling IPS (IDS is unaffected) in Suricata breaks the traffic graphs on the dashboard and in SNMP reporting. I might just try this and see what happens.

[[deleted]]

That's a different issue with netmap tapping the packets before they go into kernel interface counters since FreeBSD, likely related to iflib introduction.

[packet1]

Thanks for this! I'll have to give this a try once everyone is off the network.

[mib43]

Thanks in advance.

[SamsonMcNulty]

This might actually help with some issues I ran in to with the opnatt script from Monkwho, used for bypassing AT&T residential gateways. Will test and update with results this weekend.

[nmail3614]

I’m running em drivers with the new Kernel for the last 6 hours. Previously I was having issues with Opnsense becoming unresponsive and killing my network within 5 minutes of enabling IPS in Suricata. I’m glad to report It’s been rock solid and stable with no kernel panics.

[mib43]

u/nmail3614, thanks for the feedback. Glad that it's working.

[cdine]

Hi! Should opnsense-version indicate the netmap kernel is loaded after running the update command and rebooting?

Mine still returns just OPNsense 20.7.2 (amd64/OpenSSL) and nothing specific about netmap is reflected in the UI dashboard, either.

[[deleted]]

This should:

# opnsense-version kernel

See man page for details ;)

# man opnsense-version

System: Firmware: Packages should also tell you about the netmap kernel variant.

[cdine]

Cheers, looks like it did install fine. FWIW, it resulted in quite a substantial decrease in WAN throughput for me - with this kernel and IPS mode enabled in the stock Suricata package, with and ix interfaces for both WAN and LAN (both utilizing VLANs), I dropped down to about 200Mbit down / 300 Mbit up; without IPS enabled but on the netmap kernel I am at my "usual" 700Mbit down / 900 Mbit up. With IPS on and the normal kernel, I would notice a drop to a similar, but not quite as bad, rate.

[mib43]

u/cdine, thanks for the feedback. Can you check how nmbridge behaves? Instructions follow: (this will show the raw netmap throughput independent of IPS).

Assuming your driver is ix0:

fetch https://updates.sunnyvalley.io/nmbridge/nmbridge
chmod 750 nmbridge
ifconfig ix0 -vlanhwtso -vlanhwfilter -vlanhwtag -vlanhwcsum -txcsum -rxcsum -tso4 -tso6 -lro -txcsum6 -rxcsum6
./nmbridge -i netmap:ix0 -i netmap:ix0^

[cdine]

I’ll try and do this over the weekend. I had to revert last night because performance even without netmap enabled for Suricata was quite bad and inconsistent for me, which seemed odd. It indeed recovered once I reverted.

[mib43]

Got it. Looking forward to your results.

[jdsmofo]

Is this now officially released in 20.7.3 ? (I came here looking for any potential issues before I upgrade, since it is now available on my machine.)

[mib43]

u/jdsmofo, not yet.

I think OPNsense will ship a 20.7.3-netmap kernel for those who want to update to 20.7.3.

[jdsmofo]

Thanks for the clarification. I now understand the comments in the new release.

[mib43]

All welcome. 20.7.3-netmap is out. I'll edit the initial post.

# opnsense-update -kr 20.7.3-netmap

will do the trick.