Skip to content

IPv4 VPN pfSense tests

17-Oct-16

Looking at Windscribe VPN and wondering how much crypto capability impacts VPN conneciton. One thing I noticed while doing this is that Windscribe seems to load-balance heavily in the Texas area. My IP address would change pretty much with each connection.

First, here’s Windscribe connecting through the IP 75.126.39.93 (SoftLayer). This is a really fast test.

And here’s CPU usage during this test:

procs memory page disks faults cpu
r b w avm fre flt re pi po fr sr md0 md1 in sy cs us sy id
0 0 0 1296M 3473M 0 0 0 0 0 14 0 1 1457 178 5129 0 2 98
0 0 0 1296M 3473M 0 0 0 1 0 14 0 0 11709 262 26320 0 22 78
0 0 0 1296M 3473M 0 0 0 0 0 14 0 0 6260 139 14965 0 10 90
0 0 0 1296M 3473M 1 0 0 0 0 14 0 0 1219 239 4640 0 2 98
0 0 0 1296M 3473M 0 0 0 0 0 14 0 0 1636 266 5506 0 3 97
0 0 0 1296M 3473M 1454 0 0 0 1567 14 1 0 1150 1029 4528 6 3 92
0 0 0 1296M 3473M 1 0 0 0 0 14 0 0 1598 238 5377 0 1 98
0 0 0 1296M 3473M 0 0 0 0 0 14 0 0 1393 144 4923 0 2 98
0 0 0 1296M 3473M 6 0 0 0 0 14 0 0 2944 7754 10633 3 8 88
1 0 0 1296M 3473M 2 0 0 0 0 14 1 0 3340 10100 12767 4 10 87
0 0 0 1317M 3473M 5437 0 0 14 7392 14 2 1 2951 18436 11436 10 20 70
1 0 0 1296M 3473M 8205 0 0 6 9723 14 0 0 2675 8229 10085 5 13 82
0 0 0 1296M 3473M 11 0 0 0 0 14 0 0 2084 4658 8562 2 4 95

Now, with hardware encryption via cryptodev driver. Note that this time, I’m connected via 173.208.68.218 (Nobis Technology Group).

procs memory page disks faults cpu
r b w avm fre flt re pi po fr sr md0 md1 in sy cs us sy id
0 0 0 1291M 3472M 2 0 0 0 0 14 0 0 326 276 2849 0 0 99
0 0 0 1291M 3472M 1 0 0 0 0 14 0 0 7242 275 17068 0 15 85
0 0 0 1291M 3472M 9 0 0 0 0 14 0 0 7491 352 17579 0 11 89
0 0 0 1291M 3472M 0 0 0 0 0 14 0 0 2766 360 7814 0 3 97
0 0 0 1291M 3472M 1 0 0 0 0 14 0 0 2829 139 7868 0 4 96
0 0 0 1291M 3472M 4 0 0 0 0 14 0 0 2018 294 6275 0 2 98
2 0 0 1292M 3472M 2810 0 0 12 3783 14 0 0 987 3296 4316 2 5 94
0 0 0 1291M 3472M 10787 0 0 9 13251 14 1 2 1576 12830 5953 9 15 76
0 0 0 1291M 3472M 2 0 0 1 0 14 0 0 1386 245 4937 0 1 99
0 0 0 1291M 3472M 2 0 0 0 0 14 0 0 1698 171 5529 0 2 97
0 0 0 1291M 3472M 3 0 0 0 0 14 0 0 1599 285 5395 0 2 98
0 0 0 1291M 3472M 0 0 0 0 0 14 0 0 1486 213 5148 0 1 99
0 0 0 1291M 3472M 4 0 0 0 0 14 0 0 513 758 3392 1 1 99
0 0 0 1291M 3472M 10 0 0 0 0 14 0 0 567 1576 3806 1 2 97
0 0 0 1291M 3472M 4 0 0 0 0 14 0 0 187 627 2705 0 1 98
0 0 0 1291M 3472M 1447 0 0 0 1566 15 1 0 63 1098 2376 5 2 92
0 0 0 1291M 3472M 2 0 0 0 0 14 1 0 53 219 2277 0 0 100

There’s a modest decrease in the CPU usage (particularly user and system).

Finally, here’s a Comcast XFinity speed test. Note that this test runs twice: once for Ipv4 and once for IPv6


procs memory page disks faults cpu
r b w avm fre flt re pi po fr sr md0 md1 in sy cs us sy id
0 0 0 1274M 3476M 452 0 0 1 550 5 0 0 244 766 2625 1 1 98
0 0 0 1274M 3476M 2 0 0 0 0 13 0 0 19 94 2130 0 0 100
0 0 0 1274M 3476M 7 0 0 0 0 13 0 0 40 211 2177 0 0 100
0 0 0 1274M 3476M 2 0 0 0 0 13 0 0 58 94 2210 0 0 99
0 0 0 1274M 3476M 0 0 0 0 0 13 0 0 10553 86 23681 0 17 82
0 0 0 1274M 3476M 464 0 0 0 620 14 1 9 14639 735 32217 0 23 77
0 0 0 1274M 3476M 0 0 0 0 0 13 0 5 14529 87 31823 0 21 79
0 0 0 1274M 3476M 0 0 0 0 0 13 0 0 14634 142 32066 0 22 78
0 0 0 1274M 3476M 1 0 0 0 0 13 0 0 14556 89 31951 0 23 77
0 0 0 1274M 3476M 1 0 0 0 0 13 0 0 9084 87 20645 0 13 87
0 0 0 1274M 3476M 1 0 0 0 0 13 0 0 52 93 2191 0 1 99
0 0 0 1274M 3476M 0 0 0 0 0 14 0 0 26 86 2132 0 1 99
0 0 0 1274M 3476M 0 0 0 0 0 13 0 0 1109 138 4317 0 1 99
0 0 0 1274M 3476M 0 0 0 0 0 13 0 0 2115 85 6321 0 3 97
0 0 0 1274M 3476M 1 0 0 0 0 13 0 0 2030 97 6164 0 2 98
0 0 0 1274M 3476M 0 0 0 1 0 13 0 1 2144 84 6385 0 3 97
0 0 0 1274M 3476M 0 0 0 0 0 13 0 0 2322 84 6738 0 3 97
0 0 0 1274M 3476M 3 0 0 0 0 13 0 1 1353 161 4815 0 2 98
0 0 0 1274M 3476M 1442 0 0 0 1568 13 1 0 18 964 2204 6 2 92
0 0 0 1274M 3476M 0 0 0 0 1 13 1 0 5 86 2097 0 0 100
0 0 0 1274M 3476M 4 0 0 0 0 13 0 0 4052 95 10416 0 8 92
0 0 0 1295M 3476M 4952 0 0 13 6745 13 1 0 14211 10939 32191 7 36 57
0 0 0 1274M 3476M 8208 0 0 6 9728 13 1 0 14144 4136 32017 3 32 64
0 0 0 1274M 3476M 0 0 0 0 0 13 0 0 14288 84 31540 0 21 79
0 0 0 1274M 3476M 4 0 0 0 0 13 0 0 14125 95 31417 0 25 75
0 0 0 1274M 3476M 0 0 0 0 0 13 0 0 13866 86 30744 0 24 76
0 0 0 1274M 3476M 2 0 0 0 0 13 0 0 465 145 3040 0 0 100
0 0 0 1274M 3476M 1 0 0 0 0 13 0 0 18 88 2121 0 0 100
0 0 0 1274M 3476M 2 0 0 0 0 13 0 0 203 89 2492 0 1 99
0 0 0 1274M 3476M 1 0 0 0 0 13 0 1 2275 102 6647 0 2 98
0 0 0 1274M 3476M 2 0 0 1 0 13 0 0 2244 88 6588 0 2 98
0 0 0 1274M 3476M 1 0 0 0 0 13 0 0 2270 141 6646 0 2 98
0 0 0 1274M 3476M 2 0 0 0 0 13 0 0 2266 92 6634 0 3 97
0 0 0 1274M 3476M 0 0 0 0 0 13 0 1 2192 92 6487 0 3 97
0 0 0 1274M 3476M 8 0 0 0 0 13 0 0 158 124 2410 0 0 100
0 0 0 1274M 3476M 6 0 0 0 1 13 1 0 58 116 2205 0 0 100
0 0 0 1274M 3476M 2 0 0 0 0 13 1 9 18 146 2138 0 0 100

These results weren’t as conclusive as I’d like. For example, I got wildly varying results using the VPN when I retested. In some cases, the CPU usage was close to 40% (even with hardware crypto). I also think that the result above with hardware crypto isn’t apples-to-apples since the resulting data rates were lower (likely congestion outside of the VPN), and that’s likely limiting the taxation on the crypto—the crypto never gets exercise to the extend of the first test.

Be the first to like.

Making PlexPass Work

20-Dec-15

I’ve been using Plex for quite a while. You have to jump through some hoops (it only supports MKV files, not DVD or Blu-Ray directory structures), but it does in the end work quite well with my Fire TV stick and with the Google Nexus Player (Android TV).

I recently got a PlexPass subscription. This should let me create user profiles for people in the house. (These are called Managed Users or Home Users depending on the documentation.) I should also be able to sync contect (offline copy) to portable devices.

Except for whatever reason, the system was horribly broken in my house. The server would be unavailable for most of the UI’s–especially the one where you designate users and define what server libraries they have access to.

After a good day of debugging (total), I found that there were two reasons this didn’t work.

Security Features

One laudable thing Plex does is try to maintain a secure connection to your server. This is detailed here. Essentially, they own the plex.direct domain and can assign any number of hostnames under that address, all of which direct to your personal server. This is necessary because plex has to create a security certificate that matches the hostname of your server. This hostname additionally needs to resolve to an IP address that works. (A LAN subnet address while at home and an Internet IP address when you’re outside your home.)

The problem is that devices inside my house need to (for example) query the hostname 192-168-0-10.long_hash.plex.direct, and what is supposed to happen is that the DNS is supposed to return 192.168.0.10 (the local IP address of the server, within the LAN subnet).

Unfortunately, in my case, pfSense blocks this from happening because it doesn’t want a fully-qualified domain resolving to something within the house. The fix is to let pfSense know that plex.direct is allowed to resolve locally. This information is detailed here.

But, that didn’t fix the problem. The next thing that happened is OpenDNS (the DNS service I use) then also blocked the IP address lookup. The only way to fix that problem was to disable this option at OpenDNS:

Security setting in OpenDNS to help Plex resolve local addresses.

Security setting in OpenDNS to help Plex resolve local addresses.

NAT Reflection

Curiously, even after I got the above DNS resolution working, my Plex server still didn’t work right. I would get a message saying secure connections aren’t possible and that I need to fall back to insecure connections. This happened even when I was accessing the player web interface on the plex server. How can it not create a secure connection to itself?

I did a tcpdump to investigate. I saw that the Plex server was trying to contact my WAN address. (I had to do port-forwarding to get the server accessible outside my home network.) I assumed that while I was on my subnet, Plex clients (including the web client) would use the LAN subnet address. For whatever reason (bad coding, bad configuration), this local-addressing isn’t the case.

The Plex web client was trying to contact the Plex server through the WAN (routable Internet) address. Most NAT systems can’t do this. Luckily, pfSense can handle it well. I just had to create a NAT reflect rule (with proxy) to accept those connections and redirect them as necessary.

Curve-Ball: Disk Space

The long version of the story is that things didn’t stop there. I still couldn’t access the server. I got farther htan I did before, but the Plex Android app wasn’t syncing content. It wouldn’t transcode; it wouldn’t do anything. In fact, it wouldn’t even play a video. (Although songs were fine.)

What I found was that my Plex server was out of disk space. I basically had a 32GB booot/OS drive in there, and it was full. I did some cleaning and that helped. Then I also noticed that there’s a transcoding directory in the Plex server settings. I presume that this is set to /tmp or to the plex installation path, but in my case, both sit on a single small drive. So, I pointed it to my ZFS system, where there is plenty of space.

This has seemed to clear everything up. Huzzah!

Suspicious Quirk

I also had a long battle with Managed Users. Adding one for my wife (for example) did not show any selectable libraries I could share with her. I ended up blowing away my install, installing with the PlexPass version, and then re-adding users. It’s probably coincidence, but it seemed that when I created libraries in a different order (adding SD quality before HD), things worked. But, it’s very unscientific, and perhaps it was related to the other issues already listed.

Be the first to like.

Setting up an FTP-only user on FreeBSD

31-Oct-15

I recently bought an IP camera. (To be honest, I went on a bit of a shopping spree for IP cameras.)

These cameras support FTP as a storage mechanism for video and snapshots (motion-detecting for example).

As a result, I wanted to set up an FTP user on my FreeBSD machine.

Iniitally, I tried creating a user with a shell of /usr/sbin/nologin, but that doesn’t work for FTP. FTP users need to have a shell in /etc/shells.

I saw this post which talks about FTP requiring a shell in /etc/shells, and that adding /sbin/nologin is a bad idea. Instead, it recommends making a copy in /usr/local/bin/ and adding that copy to /etc/shells.

Instead, I made a link—in case (for some reason) there’s an update to /sbin/nologin, I want the FTP user to get an update.

ln -s /sbin/nologin /usr/local/bin/nologin-ftp-only

I then added /usr/local/bin/nologin-ftp-only to /etc/shells.

To be even more secure, I made the FTP user’s account chrooted by creating /etc/ftpchroot.

Be the first to like.

Inateck USB3 2.5″ enclosure

16-Aug-15

I got an Inateck USB 3.0 2.5″ SATA III disk enclosure. I placed my OCZ SSD in there, and got the following Crystal Disk Mark results:


-----------------------------------------------------------------------
CrystalDiskMark 5.0.2 x64 (C) 2007-2015 hiyohiyo
Crystal Dew World : http://crystalmark.info/
-----------------------------------------------------------------------
* MB/s = 1,000,000 bytes/s [SATA/600 = 600,000,000 bytes/s]
* KB = 1000 bytes, KiB = 1024 bytes

Sequential Read (Q= 32,T= 1) : 205.100 MB/s
Sequential Write (Q= 32,T= 1) : 116.950 MB/s
Random Read 4KiB (Q= 32,T= 1) : 63.336 MB/s [ 15462.9 IOPS]
Random Write 4KiB (Q= 32,T= 1) : 88.529 MB/s [ 21613.5 IOPS]
Sequential Read (T= 1) : 188.123 MB/s
Sequential Write (T= 1) : 105.710 MB/s
Random Read 4KiB (Q= 1,T= 1) : 13.939 MB/s [ 3403.1 IOPS]
Random Write 4KiB (Q= 1,T= 1) : 40.063 MB/s [ 9781.0 IOPS]

Test : 1024 MiB [H: 89.4% (99.8/111.7 GiB)] (x5) [Interval=5 sec]
Date : 2015/08/15 20:09:11
OS : Windows 8.1 Pro [6.3 Build 9600] (x64)

1 person likes this post.

HP 350 G1 i3-4005U DDR3 Benchmarks

21-Dec-14

I recently bought this laptop. It came with 4GB of DDR3L-1600 CAS-11 memory.

I also recently purchased a pair of 8GB OF DDR3L-1600 CAS-9 memory, figuring that this pair would allow for dual-channel acces and also that the CAS-9 would improve performance (not to mention that the extra memory in general would also help).

I followed the directions here: http://www.cnet.com/how-to/find-your-windows-experience-index-scores-in-windows-8-1/

And here are the benchmarks before I upgraded the memory:

__GENUS : 2
__CLASS : Win32_WinSAT
__SUPERCLASS :
__DYNASTY : Win32_WinSAT
__RELPATH : Win32_WinSAT.TimeTaken="MostRecentAssessment"
__PROPERTY_COUNT : 8
__DERIVATION : {}
__SERVER : HP-350-G1
__NAMESPACE : root\cimv2
__PATH : \\HP-350-G1\root\cimv2:Win32_WinSAT.TimeTaken="MostRece
ntAssessment"
CPUScore : 6.5
D3DScore : 4.9
DiskScore : 8.1
GraphicsScore : 4.7
MemoryScore : 5.9
TimeTaken : MostRecentAssessment
WinSATAssessmentState : 1
WinSPRLevel : 4.7
PSComputerName : HP-350-G1

… and here are the results after the memory upgrade:

C:\Users\Poojan> winsat formal -restart

C:\Users\Poojan> powershell /c Get-WmiObject -Class Win32_WinSAT

__GENUS : 2
__CLASS : Win32_WinSAT
__SUPERCLASS :
__DYNASTY : Win32_WinSAT
__RELPATH : Win32_WinSAT.TimeTaken="MostRecentAssessment"
__PROPERTY_COUNT : 8
__DERIVATION : {}
__SERVER : HP-350-G1
__NAMESPACE : root\cimv2
__PATH : \\HP-350-G1\root\cimv2:Win32_WinSAT.TimeTaken="MostRece
ntAssessment"
CPUScore : 6.5
D3DScore : 5.1
DiskScore : 8.1
GraphicsScore : 5.8
MemoryScore : 7.3
TimeTaken : MostRecentAssessment
WinSATAssessmentState : 1
WinSPRLevel : 5.1
PSComputerName : HP-350-G1

Be the first to like.

Crucial m550 128GB as ZIL/SLOG (the ZIL really does limit your performance)

26-Nov-14

I got my hands on an m550 128GB drive (for around $75 with the recent pre-Thanksgiving/pre-Christmas discounts).

Here are some comparisons between my old ZIL (the m500 128GB) and the new one:

ZIL Throughput (sustained) MB/s
none 195.6
m500 128GB 124.0
m550 128GB 265.9

Here are some snippets of zpool isotat output:

No ZIL

m500 128GB as ZIL

m550 128GB as ZIL

Be the first to like.

Crucial m550 128GB SSD benchmark

23-Nov-14

Fresh out of the box:

Curiously, there are no firmware updates for this drive (nor the m500). Guess Crucial got it right the first time.

Be the first to like.

Sandisk Extreme USB 3.0 64GB SDCZ80-064G-GAM46 Benchmark

12-Sep-14

Fresh out of the box:

That’s 167 MB/s sequential write—pretty cool. Since this is on Windows 7, there’s no UASP support, which should improve performance even more.

Be the first to like.

Fun with SchoolSpeak

10-Sep-14

So, our school has adopted SchoolSpeak as their online platform. This includes lunch orders, and I’ve been asked to help the administration out with some summary reports (at least until SchoolSpeak can directly support what we need).

Basically, I need to figure out how much money was made each day of the month, totaled by week-day.

Unfortunately, the only view that has this information is a summary of orders on a day-by-day basis. So, I need to:

  1. Download each day for the month
  2. For each day, grab the total and keep it in a running sum (categorized by week-day)
  3. Email the result to the admin

For #1, I have a single day download-able via Selenium. (Which rocks by the way!) So, it’s just a matter of making it iterate over days of the month. To do that, I need to:

  1. Accept (probably from the command-line) an month/year combination
  2. Figure out how many days there are in that month
  3. Run over a range of days and download each day. (Luckily the download is already implemented as a function which takes a m/d/y as an argument; I will probably refactor it to take a datetime argument.)

For #1, I’ll use argparse, and it looks like so:

The above accepts both year-month-day and year-month format. I intended for a year-month to be the entire month, but the datetime module will parse it as year-month-1 (1st of the month), so I’ll need to add a command-line parameter to iterate over the month.

Speaking of which, how do I figure out how many days in a month? Turns out there’s a calendar module for that. And it has an iterator over days of the month. Sweet!

Knowing that, let’s make my get-date function always return an iteratable of datetime.date’s:

More to follow…

Be the first to like.

12V dc adapter efficiency measurement

15-Aug-14

So, you remember that pfSense build that I talked about before? Well, it was drawing around 25 W.

I know, right? Unacceptable!

So, one of the things I tried to figure out is what the main power draw is. The PicoPSU accepts a 12V input. Could the ac/dc adapter be hurting my efficiency?

The adapter I have is a 12V / 5A (60W) adapter that I got for around $10 off Amazon. I figure it wasn’t anything special, and was probably not terribly high efficiency.

I decided to measure the efficiency of the ac/dc adapter. I did this by measuring the power into the adapter with a Kill-A-Watt. And to measure the output power, I used an ammeter (the ammeter function of a multimeter). (I assumed the PSU was delivering 12V; if it was a little low, my efficiency assumptions would be wrong.)

To do this, I had to cut one of the chords on the adapter and place the multimeter in series. (I could alternatively cut the input chord on the PicoPSU, but I figure an adapter is easier to come by than a PicoPSU.) Here’s a picture of how that looks:

Multimeter in series with dc supply chord

Multimeter in series with dc supply chord

And here are the readings on the Kill-A-Watt and multimeter:

Kill-A-Watt reads 20.6 W

Kill-A-Watt reads 20.6 W

 

Multi-Meter reads 1.64A

Multi-Meter reads 1.64A

Which all means that my efficiency is 1.64A * 12V = 19.68 W / 20.6 W = 95.5%.

I gotta say, I did not expect it to be that high. This is pretty cool. (And a bit surprising, since it seemed like the ac/dc adapter gets pretty warm.)

I should also note that the power draw is less than I remember. I thought it was more like 25A, but I never wrote it down, so I can’t be sure. I’ll take 20A, and be quite happy.

The current on the multimeter bounced around a bit, from 1.6 A to around 1.8 A, but it was well under 2A. Originally, I was interested in getting a (smaller) 2A supply, but I don’t see any need to, with this being so high efficiency. (And who knows, the smaller supply may be lower in efficiency, since they tend to be more compact.)

Be the first to like.