Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[XGS_Is_On]

Asymmetry issue resolved. Currently not at maximum speeds as running through an SD-WAN VM doing DPI on a not especially fast server.

https://www.speedtest.net/my-result/d/b1ae3097-bd5a-4793-b04b-db64e9ce0dc0 is where we are.

[burakkucat]

Asymmetry issue resolved.

I had previously pawed --

Asymmetric DS/US ? 

Now looking at the latest result, I'll call that symmetric. 

[XGS_Is_On]

I've also had to do some rearrangement due to incompatibility between wife's work VPN and, well, anything.

Have had to go from the previous design to two layers of routing to make sure her traffic always takes the backup.

Looks similar to a datacentre/hubsite now logically. 4 routing nodes forming 2 layers in a mesh, chatting to one another via BGP.

So much more complicated than it was, but a very familiar build.

[XGS_Is_On]

I suspect this will be a very familiar kind of set up to at least one of the members of the forum 

iBGP to the SD-WAN not allowed so had to do a little something.

[burakkucat]

Some more diagrams for me to study (and archive)! 

[Alex Atkin UK]

All Linux ISOs, and public domain material, natch. 

I tried seeding a Linux ISO torrent and couldn't get enough peers connected to get anywhere near stressing the connection. It was kinda disappointing if I'm honest.

Yeah its a chicken and egg situation. I used to download ISOs over torrent but it took longer than from the website due to lack of peers, which means I don't bother any more, meaning less peers.

Its very rare no matter what you download over torrent to hit line rate.  The problem with home broadband getting more and more asymmetrical over time.

[XGS_Is_On]

I'm talking about the upload speed not getting close, bizarrely. However many slots I opened up there just weren't enough speedy connections.

EDIT: While I'm here I should mention that the diagrams above weren't produced just for you guys: going towards both an internal knowledge base and my own academic work. Nothing personal!

[Alex Atkin UK]

I'm talking about the upload speed not getting close, bizarrely. However many slots I opened up there just weren't enough speedy connections.

Depends on the content but generally it is very peaky when its new, but then there are a lot more people seeding so even hitting my 4000KiB torrent upload limit doesn't necessarily happen.  Especially as anything new will likely also be hosted on a dedicated seedbox.  Then over time there will be more traditionally hosted mirrors available, and people will assume nobody is going to be seeding so torrents would be a last resort.

I also think a lot of people who torrent choke their downloads and have tons of other downloads going at the same time.

I suspect high seas private torrents would be very different, but so not going there.

[Chrysalis]

On a seedbox I rarely find my upload anywhere near its limit, the majority are people from america seemingly on slow DSL connections or with not enough buffers for the RTT.  When someone fast does connect, they will also only do so via one thread.

I have thought about will I host stuff from home (bunch of stuff not torrents specifically) on FTTP, I am someone who has always had the mindset, content should be hosted in a data centre, due to its redundancy, and always on by design.  But annual costs are creeping up, IP address's in particular have quadrupled in cost in 12 months,   Considerably more expensive than what the likes of AAISP supply them for.  Still thinking about it, but the money saved would be used to fund new storage etc. for my NAS.

[XGS_Is_On]

My usage is so low.  :'(

[Alex Atkin UK]

You're clearly not watching enough por..... cat videos.

[dee.jay]

Yes very familiar to me

Makes mine look very simple, though that's mostly because it is now - single Firebrick doing all the routing across the 4 VLAN's at my place. Easy peasy stuff.

Need to break up some more stuff on my LAN for some research though

[XGS_Is_On]

Didn't have any choice. There's a route for the wife's work VPN on the study router telling it to just send immediately to the comms router, where it hits the PBR and leaves the premises.

Can't do that with a single layer of routing so was order, wait, then install a new AP single homed to comms router or build a slipstream which essentially forms a DMZ.

The two routers can happily be configured with stateful firewalling on their 222 slipstream facing interfaces.  I can at my convenience add another device into the 222 range to be DMZ firewall and be destination for everything with no firewall state as it's inbound.

If it's new, send it to....

[craigski]

Didn't have any choice. There's a route for the wife's work VPN on the study router telling it to just send immediately to the comms router, where it hits the PBR and leaves the premises.

Just trying to understand this a little more. Is your LAN all private IP networks, and you are NATing on the edge router? Or do you have some public addresses locally?

Could IPv6 solve the VPN issue, assuming all equipment was IPv6 enabled?

[XGS_Is_On]

NAT on edge. I have a /29 of public IP addresses I could use on the backup. They are, where necessary, destination NAT into the LAN. There is no mixing of public and private addressing in the LAN, only IP/port mapping.

Wife's VPN is v4 only, old school, and touchy. It is fundamentally incompatible with the SD-WAN so has to be kept away else it doesn't work.

Most decent VPNs using IPSEC NAT-T will be sourced from ephemeral ports because it shouldn't really matter. Wife's employer insists on 4500 as source and destination and the SD-WAN will not do this: source port 4500 is sacred.

It was a good thing anyway. It made me build the thing properly in coherent layers instead of flat.