I'm working with astaro support but i wanted to see if anyone is getting random but often errors from astaro about connection resets or timeouts with the proxy turned on?
Well even though I've gotten rid of the packet loss, it's still slow and it looks like something is max'ing out my bandwidth.
Investigating further we've done about 7GB of traffic yesterday from Firefox mirrors. The lastest release of Firefox came out yesterday and it looks like we've been having major problems with it's auto updater. This continued this morning to the point I've blocked download.mozilla.org and ftp-mozilla.netscape.com to alleviate the traffic.
I'm not sure whether this is just a coincidence the FF update came out the day I upgraded to ASG 7.1, and the FF update is broken or whether ASG is screwing with the update.
FWIW, I noticed one of the FF Update mirrors with a .jp TLD was blocked by the content filter (as unknown, I think). I don't see that using any external bandwidth though, since it's blocked.
Specifically regarding Mozilla downloads (Firefox). Their downloads seem to work on a round robin of servers. If you kick off a download, and it's slow, stop it and kick it off again until you get to a local server that gives you decent performance for the download. Each time you start it, you'll probably be on a different server. Some of them are simply very slow, and some quite fast.
Yep that's what happened, eganders. I initially blocked ftp-mozilla.netscape.com thinking there was a problem downloading the update from their site, and the clients switched to another site which I left running over night hoping it would sort itself out.
Nope, no love. I had to block the download.mozilla.org domain to it couldn't find another mirror.
Hi all , is not a mozilla-servers problem but is the new HTTP-Proxy that have a lot of problems. There are same missconfigurations among the net-conf and the net-filter files due the kernel can't dialog with them. We must wait the next update and take the Proxy stopped at this moment ---and NOT any-any-any in the packet filter rules. in this way you can do everything without the firewall---.
The problem seems to be the HTTP and DNS proxies (haven't tried the generic); I was getting dropped packets on both http and dns ports.
Note: I didn't set a filter for any-any-any. The source is the external IP address, externalIP-any-any. Granted the services should really be just http(s) and dns though.
Can you please login to your ASG, and provide the output of the 'top' command when there are a lot of users are using the proxy? What do you have configured regarding caching/virus scanning in the HTTP Proxy?
Note: I didn't set a filter for any-any-any. The source is the external IP address, externalIP-any-any. Granted the services should really be just http(s) and dns though.
My packets were also showing the external IP as the source until support found something in my snat/dnat rules. After they made the change, the packets started showing with the actual source IP of the originating computer. Still dropping them like mad, but at least now they had the right IP showing up.
I wish I could tell you exactly what they did, but I just don't know what that was.
My packets were also showing the external IP as the source until support found something in my snat/dnat rules. After they made the change, the packets started showing with the actual source IP of the originating computer. Still dropping them like mad, but at least now they had the right IP showing up.
I wish I could tell you exactly what they did, but I just don't know what that was.
Hmm, I was contemplating recreating my NAT rules. Now you've said this I might do it and see what happens.
