Documentation on how to enable/use hardware NAT?

Question

Documentation on how to enable/use hardware NAT?

opened this issue 4 years ago · comments

I have compiled this firmware for my Zyxel NBG6817, selecting kmod-qca-ssdk-hnat and qca-ssdk-shell.
The included init script at /etc/init.d/qca-ssdk does not change anything regarding wired throughput.
Unfortunately, documentation for ssdk_sh is sparse and confusing. Any idea how to get hardware NAT working? What are the maximum wired LAN - WAN speeds?

jollaman999 · Answer 1 · Tue Sep 08 2020 09:13:34 GMT+0800 (China Standard Time)

@04dco You are selected right options. I only checked that driver is initialized correctly.
I don't have much knowledge about this driver.

In my situation, I'm using 500Mbps for internet. And I have full speed for LAN-WAN wired connection.
But it is little slower for wireless connection.
I have 350~370Mbps for 5Ghz channel WLAN.

I think /etc/init.d/qca-ssdk file is not doing anything for ssdk driver currently.

And you can reference my configuration here.
https://github.com/jollaman999/openwrt/blob/master/jolla_ZyXEL_NBG6817_defconfig

Thank you for viewing my source.

jollaman999 · Answer 2 · Tue Sep 08 2020 09:16:03 GMT+0800 (China Standard Time)

@04dco If ssdk driver loaded correctly, you can see the kernel log like this.

[   14.258784] PPP generic driver version 2.4.2
[   14.374571] ssdk_switch_device_num_init[989]:INFO:ess-switch dts node number: 1
[   14.374678] ssdk_dt_get_switch_node[824]:WARN:cannot find ess-switch node
[   14.380762] ssdk_plat_init start
[   14.387803] ssdk_driver_register[2436]:INFO:Register QCA PHY driver
[   15.172584] f1_phy_api_ops_init[1513]:INFO:qca probe f1 phy driver succeeded!
[   15.172647] regi_init[3393]:INFO:qca-ssdk module init succeeded!

Deleted user · Answer 3 · Wed Sep 09 2020 16:53:06 GMT+0800 (China Standard Time)

Driver loads correctly but only has 450 Mbps of throughput.
In release 19.07.3 with option firewall.@defaults[0].flow_offloading='1' I get 900+ Mbps.

There has been an effort to get the IPQ806x NSS subsystem working on OpenWrt (using the NSS cores on the SoC for NAT/crypto). Perhaps that might interest you.
https://forum.openwrt.org/t/ipq806x-nss-drivers/12613

[   11.928468] ssdk_switch_device_num_init[989]:INFO:ess-switch dts node number: 1
[   11.928573] ssdk_dt_get_switch_node[824]:WARN:cannot find ess-switch node
[   11.934661] ssdk_plat_init start
[   11.941673] ssdk_driver_register[2436]:INFO:Register QCA PHY driver
[   12.724425] f1_phy_api_ops_init[1513]:INFO:qca probe f1 phy driver succeeded!
[   12.724482] regi_init[3393]:INFO:qca-ssdk module init succeeded!

jollaman999 · Answer 4 · Wed Sep 09 2020 17:16:10 GMT+0800 (China Standard Time)

@04dco You mean, you got 900+ Mbps with no ssdk driver?

I saw that thread. It's really interesting but NSS driver is optimized for 3.18 kernel.
I think I had tried with 4.4 or 4.9 kernel in last year.
But it was really hard to porting. So I am currently giving up.

Anyway, thank you for your information.
I need test with 1G speed in a different way, like below, when I have a time.
WAN-[Some Router]-LAN---(1G)----[NBG6817]

Deleted user · Answer 5 · Wed Sep 09 2020 17:29:14 GMT+0800 (China Standard Time)

OpenWrt has a wiki page for testing NAT and routing performance on IPv4 and IPv6. You need two LAN clients and the router itself. Throughput testing is done with Jperf/iperf3.

IPv4/NAT: https://openwrt.org/docs/guide-user/perf_and_log/benchmark.nat
IPv6/Routing: https://openwrt.org/docs/guide-user/perf_and_log/benchmark.ipv6.routing

Aleksei Nosachev · Answer 6 · Sun Jan 03 2021 20:53:35 GMT+0800 (China Standard Time)

@04dco You mean, you got 900+ Mbps with no ssdk driver?

I saw that thread. It's really interesting but NSS driver is optimized for 3.18 kernel.
I think I had tried with 4.4 or 4.9 kernel in last year.
But it was really hard to porting. So I am currently giving up.

Anyway, thank you for your information.
I need test with 1G speed in a different way, like below, when I have a time.
WAN-[Some Router]-LAN---(1G)----[NBG6817]

Is it possible to combine both? NSS and HWNAT
I mean I am willing to use gigabit internet connection, but would be nice to have wireguard accelerated at the same time to free up cpu for media/hdd/php usage

jollaman999 · Answer 7 · Tue Jun 08 2021 23:55:07 GMT+0800 (China Standard Time)

@nos1609
Tested with NSS + SSDK driver.
It shows lower speed with more CPU consumption and poor speed related with crypto drivers.
I'm using ipq806x (NBG6817) device with 500Mbps internet.

[No NSS + SSDK]
It shows '450-500Mbps' speed for both download and upload through "fast.com" and "speedtest.net".
It shows about '450~490Mbps' wireless speed through "fast.com" (Tested with 5Ghz with CCMP(AES)/1-2m distance.)
OpenVPN with CHACHA20-POLY1305 : It shows about '90-120Mbps' speed.
OpenVPN with AES-256-GCM : It shows about '50-80Mbps' speed.

[WithNSS + SSDK]
It shows more CPU consumption while checking speed test.
It shows '300-450Mbps' for both download and upload speed through "fast.com".
It shows '470-500Mbps' download speed and '300-400Mbps' upload speed through "speedtest.net".
Sometimes ath10k driver is failed to load or stopped working .
It shows poor wireless speed. (Tested with 5Ghz with CCMP(AES)/1-2m distance. It shows about '250~380Mbps speed')
OpenVPN with CHACHA20-POLY1305 : It shows about '30-50Mbps' speed. (What the...?)
OpenVPN with AES-256-GCM : It shows about '30Mbps' speed.

jollaman999 · Answer 8 · Wed Jun 09 2021 00:12:53 GMT+0800 (China Standard Time)

@ghost
Tested with iperf3 with 1Gbps connection in 5.10 kernel with SSDK.
It shows 1Gbps full speed for both NAT (WAN--LAN) and lan test.

PS.
You should turn off offload option. It shows poor speed with offload enabled.