Skip to content
Register

NAT64 gateway on my IPv4 box—helping the transition or enabling delusion?

VPS Hosting by pavel_train 15 replies 1.6K views
pavel_train

Member OP

#1

Cat idea | grep "ipv6 is future" | sort -u | wc -l
Result: everyone says this | nobody does anything

So I run NAT64 on my old CloudCone IPv4 VPS | 2 cores | 4GB RAM | tayga daemon | translating v6 to v4 for free | anyone can point at my box

First week: 3 users | nice | helping transition
Second week: 200gbps throughput | not nice | someone streaming video through me | grep abuse | sed 's/nice/foolish/'

Now I rate limit | 10mbit per IP | tc rules | nftables marks | the commons is tragic | cat /var/log/tragedy | wc -l
Result: very many lines

Still running it | but the optimism is filtered | like the packets | drop rate 40% | incha'allah the good users stay

beto60

Member

#2

Caramba! 200gbps nossa!! You are generous soul, pavel_train, but internet dont have generous soul back,

I try to run something similar once, not NAT64 but open proxy, I dont need to tell you what happen, ne? The tragedy of commons is not theory, is tuesday

But I admire you keep going with limits. Maybe is not delusion, maybe is stubbornness, and stubbornness is not so bad

SingaporeRep

Member

Benchmark Addict

#3 
# yabs.sh on NAT64 gateway after rate limiting
fio disk tests:
  read:  82.4 MB/s (4k), 210 MB/s (1M)
  write: 74.1 MB/s (4k), 195 MB/s (1M)

iperf3 to v6 target:
  [  5]   0.00-10.00  sec  11.2 MBytes  9.41 Mbits/sec
  [  5]  10.00-20.00  sec  11.2 MBytes  9.41 Mbits/sec

iperf3 to v4 target via tayga:
  [  5]   0.00-10.00  sec  8.7 MBytes  7.31 Mbits/sec
  [  5]  10.00-20.00  sec  8.7 MBytes  7.31 Mbits/sec

Decent disk IO, meh network. Translation overhead: ~22% throughput loss. CPU not bottleneck, tayga is single-threaded.

Comparison:
- direct v4: 7.31 mbit usable
- your rate limit: 10 mbit theoretical
- actual per-user: probably worse with contention

Numbers say the service is technically functional. Generosity is the broken part. Ran with https://github.com/masonr/yet-another-bench-script

fio, iperf, geekbench. results or gtfo.
lee_mcr

Member

#4

Right then, proper tragedy this. I've run Hostinger's free tier for years and the abuse curve is always the same: day 3, someone finds you; day 10, you're a VPN node for half of who-knows-where.

Your rate limiting is sensible. I'd have pulled the plug entirely, cheers for the stubbornness.

Honest limit though: free NAT64 is worth exactly what people pay for it. The ones who need it will tolerate 10mbit. The ones who don't will scream and leave. Feature, not bug.

Honey badger don't care... about downtime
olespete

Member

Trust No One

#5

200gbps on a 2 core CloudCone box? Something doesnt add up

airgapped, encrypted, faraday'd, still worried
LO

Member

#6

What kernel version running tayga? I had crashes on 5.4 with conntrack

pavel_train

Member OP

#7
olespete said:
200gbps on a 2 core CloudCone box? Something doesnt add up

You read correctly | I did not say 200gbps sustained | I said 200gbps throughput | peak | burst | someone with udp flood aspirations | the 10gbit port saturated for seconds | then my provider nullrouted | then I wrote email | then they un-nullrouted | then I added tc

CloudCone in Los Angeles | 1gbit shared | burst to 10gbit | theoretical | not practical | the 200gbps is sum of peaks over week | not single pipe | my english is technical but not perfect | sorry for confusion

olespete

Member

Trust No One

#8

Ah, cumulative. That makes more sense. I thought you had some secret 200gbit CloudCone plan the rest of us missed.

airgapped, encrypted, faraday'd, still worried
SingaporeRep

Member

Benchmark Addict

#9
pavel_train said:
Sum of peaks over week

That clarification changes the analysis. 200gbps cumulative / 7 days = average ~330mbit sustained if spread evenly, which it wasn't. The abuse profile is spiky, not constant load.

My iperf3 numbers above were from your gateway post-rate-limit, not pre. Would be interesting to see pre-limit throughput but I understand you won't remove limits for science.

Single-threaded tayga at 7.3mbit after translation suggests CPU headroom for maybe 15-20 concurrent users at that rate before saturation. How many active sessions you seeing now?

fio, iperf, geekbench. results or gtfo.
pavel_train

Member OP

#10
SingaporeRep said:
How many active sessions you seeing now?

Ss -6 state established | wc -l | average 340 | peak 900 | most are idle | tcp keepalive | real active flows maybe 80-120 | tayga cpu 15-25% | headroom exists | the limit is policy not hardware

I could raise to 20mbit | but 10mbit filters the streamers | this is the goal | quality of user over quantity of byte

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft