I retested on my end with hashsize bumped to 65536. 147 Mbps -> 312 Mbps, CPU 61%. Better but not clean. Raw table rule took me to 940 Mbps line rate, CPU 18%.
Conntrack is a tax.
Member
I plotted nf_conntrack_count against peer count on my setup. Linear to about 80 peers, then knee at 120, then cliff. The hash collision path is real.
Raw table or dedicated conntrack bypass module are only sane paths at scale.
The RAM it eats! I forget to say! My server it is only 1GB and I use 180MB for conntrack after the fix! This is big!
Before the fix the server it die. After the fix the server it live but hungry (´・ω・｀)
I think for malý server the raw table is best. No memory, no problem.
I did not fix with bigger table. I moved to Hetzner Singapore, same specs, half price, fresh install. Problem identical. It is not provider. It is Linux.
Now I use the raw table rule. 3 months, zero stalls.
But the point stands. This is kernel behavior, not provider.
For anyone keeping score, my 52 VPS spreadsheet says:
The raw table rule is portable. The module param is not.
The repo PetraSuper mention, I check it. It is not official RackNerd repo, it is someone on GitHub with RackNerd in name. The module .ko inside, no source, no signature. I do not load this on my server.
Raw table rule is free and safe. Why use mystery module?
