Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 25378 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.476 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.476/0.476/0.476/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.446 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.446/0.446/0.446/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 56570 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 75.2 MBytes 631 Mbits/sec 123 1.58 MBytes [ 5] 1.00-2.00 sec 61.2 MBytes 514 Mbits/sec 0 1.73 MBytes [ 5] 2.00-3.00 sec 81.2 MBytes 682 Mbits/sec 0 1.87 MBytes [ 5] 3.00-4.00 sec 97.5 MBytes 818 Mbits/sec 0 1.97 MBytes [ 5] 4.00-5.00 sec 95.0 MBytes 797 Mbits/sec 12 1.47 MBytes [ 5] 5.00-6.00 sec 96.2 MBytes 807 Mbits/sec 0 1.55 MBytes [ 5] 6.00-7.00 sec 83.8 MBytes 703 Mbits/sec 0 1.61 MBytes [ 5] 7.00-8.00 sec 85.0 MBytes 713 Mbits/sec 0 1.65 MBytes [ 5] 8.00-9.00 sec 100 MBytes 839 Mbits/sec 0 1.67 MBytes [ 5] 9.00-10.00 sec 97.5 MBytes 818 Mbits/sec 0 1.69 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 873 MBytes 732 Mbits/sec 135 sender [ 5] 0.00-10.01 sec 871 MBytes 730 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
09/05/2025-10:21:53.998300 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56558 -> 40.0.0.2:5001 09/05/2025-10:21:53.999166 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56570 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 58957 0 --:--:-- --:--:-- --:--:-- 64500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.569 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.569/0.569/0.569/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.452 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.452/0.452/0.452/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 58982 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 134 MBytes 1.13 Gbits/sec 19 1.76 MBytes [ 5] 1.00-2.00 sec 272 MBytes 2.29 Gbits/sec 0 1.93 MBytes [ 5] 2.00-3.00 sec 291 MBytes 2.44 Gbits/sec 0 2.07 MBytes [ 5] 3.00-4.00 sec 298 MBytes 2.50 Gbits/sec 0 2.18 MBytes [ 5] 4.00-5.00 sec 244 MBytes 2.04 Gbits/sec 8 1.59 MBytes [ 5] 5.00-6.00 sec 232 MBytes 1.95 Gbits/sec 21 1.90 MBytes [ 5] 6.00-7.00 sec 366 MBytes 3.07 Gbits/sec 0 2.06 MBytes [ 5] 7.00-8.00 sec 384 MBytes 3.22 Gbits/sec 16 1.54 MBytes [ 5] 8.00-9.00 sec 324 MBytes 2.72 Gbits/sec 0 1.68 MBytes [ 5] 9.00-10.00 sec 309 MBytes 2.59 Gbits/sec 0 1.81 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.79 GBytes 2.39 Gbits/sec 64 sender [ 5] 0.00-10.00 sec 2.79 GBytes 2.39 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
09/05/2025-10:22:27.256192 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58976 -> 40.0.0.2:5001 09/05/2025-10:22:27.257211 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58982 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Sep 05 10:22:17.331230 osdx systemd-journald[1764]: Runtime Journal (/run/log/journal/8e652e5518b84f0bb5a60f6ad502329f) is 2.0M, max 13.8M, 11.7M free. Sep 05 10:22:17.333168 osdx systemd-journald[1764]: Received client request to rotate journal, rotating. Sep 05 10:22:17.333215 osdx systemd-journald[1764]: Vacuuming done, freed 0B of archived journals from /run/log/journal/8e652e5518b84f0bb5a60f6ad502329f. Sep 05 10:22:17.340962 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'system journal clear'. Sep 05 10:22:17.559759 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'system coredump delete all'. Sep 05 10:22:17.791644 osdx OSDxCLI[216255]: User 'admin' entered the configuration menu. Sep 05 10:22:17.870109 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Sep 05 10:22:17.954582 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Sep 05 10:22:18.011885 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Sep 05 10:22:18.107172 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Sep 05 10:22:18.167594 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Sep 05 10:22:18.262014 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Sep 05 10:22:18.341625 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'show working'. Sep 05 10:22:18.430277 osdx ubnt-cfgd[216704]: inactive Sep 05 10:22:19.273570 osdx INFO[216714]: FRR daemons did not change Sep 05 10:22:19.297197 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Sep 05 10:22:19.361170 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Sep 05 10:22:19.384126 osdx (udev-worker)[216834]: Network interface NamePolicy= disabled on kernel command line. Sep 05 10:22:19.552810 osdx cfgd[1461]: [216255]Completed change to active configuration Sep 05 10:22:19.563961 osdx OSDxCLI[216255]: User 'admin' committed the configuration. Sep 05 10:22:19.595241 osdx OSDxCLI[216255]: User 'admin' left the configuration menu. Sep 05 10:22:22.926667 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Sep 05 10:22:23.004871 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Sep 05 10:22:23.124055 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Sep 05 10:22:23.630772 osdx file_operation[217001]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Sep 05 10:22:23.651290 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Sep 05 10:22:23.781905 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Sep 05 10:22:23.922784 osdx OSDxCLI[216255]: User 'admin' entered the configuration menu. Sep 05 10:22:23.985268 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Sep 05 10:22:24.081200 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Sep 05 10:22:24.137853 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Sep 05 10:22:24.241804 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Sep 05 10:22:24.299163 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Sep 05 10:22:24.408388 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Sep 05 10:22:24.501486 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Sep 05 10:22:24.559127 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Sep 05 10:22:24.657856 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Sep 05 10:22:24.723904 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Sep 05 10:22:24.871615 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Sep 05 10:22:24.948308 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Sep 05 10:22:25.063344 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Sep 05 10:22:25.152051 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Sep 05 10:22:25.223322 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Sep 05 10:22:25.349488 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Sep 05 10:22:25.412590 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Sep 05 10:22:25.536071 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Sep 05 10:22:25.593527 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Sep 05 10:22:25.691994 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Sep 05 10:22:25.800042 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'show working'. Sep 05 10:22:25.882056 osdx ubnt-cfgd[217052]: inactive Sep 05 10:22:25.950705 osdx INFO[217089]: FRR daemons did not change Sep 05 10:22:26.413609 osdx systemd[1]: Reloading. Sep 05 10:22:26.449174 osdx systemd-sysv-generator[217149]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Sep 05 10:22:26.593572 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Sep 05 10:22:26.616280 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Sep 05 10:22:26.809096 osdx INFO[217131]: Rules successfully loaded Sep 05 10:22:26.810015 osdx cfgd[1461]: [216255]Completed change to active configuration Sep 05 10:22:26.812277 osdx OSDxCLI[216255]: User 'admin' committed the configuration. Sep 05 10:22:26.836841 osdx OSDxCLI[216255]: User 'admin' left the configuration menu. Sep 05 10:22:27.257180 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=55394 DF PROTO=TCP SPT=58976 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Sep 05 10:22:27.257265 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=11640 DF PROTO=TCP SPT=58982 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Sep 05 10:22:37.489971 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 35266 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 317 MBytes 2.66 Gbits/sec 1 1.90 MBytes [ 5] 1.00-2.00 sec 309 MBytes 2.59 Gbits/sec 0 2.06 MBytes [ 5] 2.00-3.00 sec 225 MBytes 1.89 Gbits/sec 482 1.56 MBytes [ 5] 3.00-4.00 sec 276 MBytes 2.32 Gbits/sec 2 1.24 MBytes [ 5] 4.00-5.00 sec 372 MBytes 3.12 Gbits/sec 0 1.42 MBytes [ 5] 5.00-6.00 sec 322 MBytes 2.71 Gbits/sec 0 1.58 MBytes [ 5] 6.00-7.00 sec 308 MBytes 2.58 Gbits/sec 0 1.72 MBytes [ 5] 7.00-8.00 sec 310 MBytes 2.60 Gbits/sec 0 1.85 MBytes [ 5] 8.00-9.00 sec 310 MBytes 2.60 Gbits/sec 0 1.97 MBytes [ 5] 9.00-10.00 sec 241 MBytes 2.02 Gbits/sec 32 1.45 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.92 GBytes 2.51 Gbits/sec 517 sender [ 5] 0.00-10.00 sec 2.92 GBytes 2.51 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
09/05/2025-10:22:27.256192 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58976 -> 40.0.0.2:5001 09/05/2025-10:22:27.257211 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58982 -> 40.0.0.2:5001 09/05/2025-10:22:42.079096 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35262 -> 40.0.0.2:5001 09/05/2025-10:22:42.079903 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35266 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Sep 05 10:22:17.331230 osdx systemd-journald[1764]: Runtime Journal (/run/log/journal/8e652e5518b84f0bb5a60f6ad502329f) is 2.0M, max 13.8M, 11.7M free. Sep 05 10:22:17.333168 osdx systemd-journald[1764]: Received client request to rotate journal, rotating. Sep 05 10:22:17.333215 osdx systemd-journald[1764]: Vacuuming done, freed 0B of archived journals from /run/log/journal/8e652e5518b84f0bb5a60f6ad502329f. Sep 05 10:22:17.340962 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'system journal clear'. Sep 05 10:22:17.559759 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'system coredump delete all'. Sep 05 10:22:17.791644 osdx OSDxCLI[216255]: User 'admin' entered the configuration menu. Sep 05 10:22:17.870109 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Sep 05 10:22:17.954582 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Sep 05 10:22:18.011885 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Sep 05 10:22:18.107172 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Sep 05 10:22:18.167594 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Sep 05 10:22:18.262014 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Sep 05 10:22:18.341625 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'show working'. Sep 05 10:22:18.430277 osdx ubnt-cfgd[216704]: inactive Sep 05 10:22:19.273570 osdx INFO[216714]: FRR daemons did not change Sep 05 10:22:19.297197 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Sep 05 10:22:19.361170 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Sep 05 10:22:19.384126 osdx (udev-worker)[216834]: Network interface NamePolicy= disabled on kernel command line. Sep 05 10:22:19.552810 osdx cfgd[1461]: [216255]Completed change to active configuration Sep 05 10:22:19.563961 osdx OSDxCLI[216255]: User 'admin' committed the configuration. Sep 05 10:22:19.595241 osdx OSDxCLI[216255]: User 'admin' left the configuration menu. Sep 05 10:22:22.926667 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Sep 05 10:22:23.004871 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Sep 05 10:22:23.124055 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Sep 05 10:22:23.630772 osdx file_operation[217001]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Sep 05 10:22:23.651290 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Sep 05 10:22:23.781905 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Sep 05 10:22:23.922784 osdx OSDxCLI[216255]: User 'admin' entered the configuration menu. Sep 05 10:22:23.985268 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Sep 05 10:22:24.081200 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Sep 05 10:22:24.137853 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Sep 05 10:22:24.241804 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Sep 05 10:22:24.299163 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Sep 05 10:22:24.408388 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Sep 05 10:22:24.501486 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Sep 05 10:22:24.559127 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Sep 05 10:22:24.657856 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Sep 05 10:22:24.723904 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Sep 05 10:22:24.871615 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Sep 05 10:22:24.948308 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Sep 05 10:22:25.063344 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Sep 05 10:22:25.152051 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Sep 05 10:22:25.223322 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Sep 05 10:22:25.349488 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Sep 05 10:22:25.412590 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Sep 05 10:22:25.536071 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Sep 05 10:22:25.593527 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Sep 05 10:22:25.691994 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Sep 05 10:22:25.800042 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'show working'. Sep 05 10:22:25.882056 osdx ubnt-cfgd[217052]: inactive Sep 05 10:22:25.950705 osdx INFO[217089]: FRR daemons did not change Sep 05 10:22:26.413609 osdx systemd[1]: Reloading. Sep 05 10:22:26.449174 osdx systemd-sysv-generator[217149]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Sep 05 10:22:26.593572 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Sep 05 10:22:26.616280 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Sep 05 10:22:26.809096 osdx INFO[217131]: Rules successfully loaded Sep 05 10:22:26.810015 osdx cfgd[1461]: [216255]Completed change to active configuration Sep 05 10:22:26.812277 osdx OSDxCLI[216255]: User 'admin' committed the configuration. Sep 05 10:22:26.836841 osdx OSDxCLI[216255]: User 'admin' left the configuration menu. Sep 05 10:22:27.257180 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=55394 DF PROTO=TCP SPT=58976 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Sep 05 10:22:27.257265 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=11640 DF PROTO=TCP SPT=58982 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Sep 05 10:22:37.489971 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Sep 05 10:22:37.587142 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'system journal show | cat'. Sep 05 10:22:37.734166 osdx OSDxCLI[216255]: User 'admin' entered the configuration menu. Sep 05 10:22:37.796874 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Sep 05 10:22:37.898556 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Sep 05 10:22:37.954057 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Sep 05 10:22:38.052498 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Sep 05 10:22:38.111950 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Sep 05 10:22:38.214031 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Sep 05 10:22:38.294225 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Sep 05 10:22:38.379676 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Sep 05 10:22:38.438623 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Sep 05 10:22:38.538230 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Sep 05 10:22:38.595749 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Sep 05 10:22:38.700101 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Sep 05 10:22:38.758389 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Sep 05 10:22:38.867332 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Sep 05 10:22:38.922520 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Sep 05 10:22:39.024812 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Sep 05 10:22:39.083991 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Sep 05 10:22:39.186930 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Sep 05 10:22:39.258744 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Sep 05 10:22:39.364141 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Sep 05 10:22:39.440329 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Sep 05 10:22:39.535085 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Sep 05 10:22:39.596842 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Sep 05 10:22:39.700684 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Sep 05 10:22:39.779894 osdx OSDxCLI[216255]: User 'admin' added a new cfg line: 'show changes'. Sep 05 10:22:39.883399 osdx ubnt-cfgd[217270]: inactive Sep 05 10:22:39.924782 osdx INFO[217286]: FRR daemons did not change Sep 05 10:22:40.147728 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Sep 05 10:22:41.634993 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Sep 05 10:22:41.635101 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Sep 05 10:22:41.635131 osdx systemd[1]: suricata@FW.service: Consumed 1.570s CPU time. Sep 05 10:22:41.657522 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Sep 05 10:22:41.674685 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Sep 05 10:22:41.851465 osdx INFO[217311]: Rules successfully loaded Sep 05 10:22:41.852125 osdx cfgd[1461]: [216255]Completed change to active configuration Sep 05 10:22:41.855011 osdx OSDxCLI[216255]: User 'admin' committed the configuration. Sep 05 10:22:41.880356 osdx OSDxCLI[216255]: User 'admin' left the configuration menu. Sep 05 10:22:42.081180 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=62505 DF PROTO=TCP SPT=35262 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Sep 05 10:22:42.081257 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=2829 DF PROTO=TCP SPT=35266 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Sep 05 10:22:47.030820 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Sep 05 10:22:52.547133 osdx OSDxCLI[216255]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 24845 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.566 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.566/0.566/0.566/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.477 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.477/0.477/0.477/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 55100 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 77.2 MBytes 648 Mbits/sec 24 1.75 MBytes [ 5] 1.00-2.00 sec 95.0 MBytes 797 Mbits/sec 0 1.93 MBytes [ 5] 2.00-3.00 sec 286 MBytes 2.40 Gbits/sec 0 2.08 MBytes [ 5] 3.00-4.00 sec 272 MBytes 2.29 Gbits/sec 25 1.54 MBytes [ 5] 4.00-5.00 sec 310 MBytes 2.60 Gbits/sec 0 1.69 MBytes [ 5] 5.00-6.01 sec 289 MBytes 2.41 Gbits/sec 0 1.81 MBytes [ 5] 6.01-7.00 sec 288 MBytes 2.43 Gbits/sec 0 1.92 MBytes [ 5] 7.00-8.00 sec 346 MBytes 2.90 Gbits/sec 0 2.03 MBytes [ 5] 8.00-9.00 sec 320 MBytes 2.68 Gbits/sec 0 2.15 MBytes [ 5] 9.00-10.00 sec 385 MBytes 3.23 Gbits/sec 0 2.25 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.61 GBytes 2.24 Gbits/sec 49 sender [ 5] 0.00-10.00 sec 2.60 GBytes 2.24 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
09/05/2025-10:23:17.063407 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55086 -> 40.0.0.2:5001 09/05/2025-10:23:17.064542 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55100 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=135 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=135 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=55100 dport=5001 packets=1931500 bytes=2897240197 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55100 packets=265591 bytes=13803084 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=47 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=47 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=55086 dport=5001 packets=16 bytes=1302 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55086 packets=13 bytes=1019 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 39046 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 299 MBytes 2.51 Gbits/sec 11 1.92 MBytes [ 5] 1.00-2.00 sec 301 MBytes 2.53 Gbits/sec 0 2.08 MBytes [ 5] 2.00-3.00 sec 308 MBytes 2.58 Gbits/sec 331 1.56 MBytes [ 5] 3.00-4.00 sec 316 MBytes 2.65 Gbits/sec 0 1.70 MBytes [ 5] 4.00-5.00 sec 241 MBytes 2.02 Gbits/sec 0 1.80 MBytes [ 5] 5.00-6.00 sec 239 MBytes 2.00 Gbits/sec 22 1.88 MBytes [ 5] 6.00-7.00 sec 314 MBytes 2.63 Gbits/sec 0 2.05 MBytes [ 5] 7.00-8.00 sec 315 MBytes 2.64 Gbits/sec 8 1.53 MBytes [ 5] 8.00-9.00 sec 309 MBytes 2.59 Gbits/sec 0 1.67 MBytes [ 5] 9.00-10.00 sec 351 MBytes 2.95 Gbits/sec 0 1.81 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.92 GBytes 2.51 Gbits/sec 372 sender [ 5] 0.00-10.00 sec 2.92 GBytes 2.51 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
09/05/2025-10:23:17.063407 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55086 -> 40.0.0.2:5001 09/05/2025-10:23:17.064542 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55100 -> 40.0.0.2:5001 09/05/2025-10:23:31.947688 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39034 -> 40.0.0.2:5001 09/05/2025-10:23:31.948770 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39046 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=39034 dport=5001 packets=16 bytes=1302 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=39034 packets=13 bytes=1019 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=39046 dport=5001 packets=2167826 bytes=3251726773 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=39046 packets=390122 bytes=20277796 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 10642 0 --:--:-- --:--:-- --:--:-- 11111
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.512 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.512/0.512/0.512/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.439 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.439/0.439/0.439/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
09/05/2025-10:24:07.882532 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49964 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=138 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=138 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=50 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=50 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=49964 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=49964 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
09/05/2025-10:24:07.882532 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49964 -> 40.0.0.2:5000 09/05/2025-10:24:14.254256 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49964 -> 40.0.0.2:5000 09/05/2025-10:24:17.093474 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49870 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=49870 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=49870 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 780 2 - 5 5 281 281 --------------------------------------------------------------------- Total 11 11 780 780
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 31563 0 --:--:-- --:--:-- --:--:-- 32250
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.612 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.612/0.612/0.612/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.551 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.551/0.551/0.551/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
09/05/2025-10:24:39.510717 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46530 -> 40.0.0.2:5001 09/05/2025-10:24:39.511719 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46540 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=46540 dport=5001 packets=24614 bytes=36912357 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46540 packets=3293 bytes=177916 [ASSURED] [OFFLOAD, packets=24604 bytes=36901656 packets=3291 bytes=177804] mark=129834765 use=2 icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=141 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=141 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=46530 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46530 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=53 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=53 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 4648 0 --:--:-- --:--:-- --:--:-- 4750
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
09/05/2025-10:24:39.510717 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46530 -> 40.0.0.2:5001 09/05/2025-10:24:39.511719 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46540 -> 40.0.0.2:5001 09/05/2025-10:24:41.790144 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46542 -> 40.0.0.2:5001 09/05/2025-10:24:41.791714 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:41345 -> 40.0.0.2:5001 09/05/2025-10:24:41.802794 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:41345 -> 40.0.0.2:5001 09/05/2025-10:24:41.814832 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:41345 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=46542 dport=5001 packets=7 bytes=555 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46542 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=1 bytes=52 packets=4 bytes=211] mark=129834765 use=3 udp 17 src=20.0.0.2 dst=40.0.0.2 sport=41345 dport=5001 packets=15 bytes=20696 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=41345 packets=1 bytes=32 [OFFLOAD, packets=11 bytes=16236 packets=0 bytes=0] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 44414 0 --:--:-- --:--:-- --:--:-- 50000
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.592 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.592/0.592/0.592/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.528 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.528/0.528/0.528/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
09/05/2025-10:25:00.905122 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57362 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 57362 yes 201 0 0 0 20.0.0.2 40.0.0.2 57362 5000 yes 201 0 8 673
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250343s ending at 1757067904.634699 XDP_DROP 9 pkts ( 4 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 10462742 pkts ( 8 pps) 13431818 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
09/05/2025-10:25:00.905122 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57362 -> 40.0.0.2:5000 09/05/2025-10:25:04.773234 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:36993 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 57362 yes 201 0 0 0 40.0.0.2 20.0.0.2 5001 36993 no 201 0 0 0 20.0.0.2 40.0.0.2 57362 5000 yes 201 0 11 847 20.0.0.2 40.0.0.2 36993 5001 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250306s ending at 1757067908.479018 XDP_DROP 11 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 10462780 pkts ( 0 pps) 13431821 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)