we have several reports now that NetFlow collection had a huge impact on performance.
Maybe we should replace current pmacct with another solution,
there is some alternative natively supported in iptables
please consider replacement, it will be great to have it in 1.2 if possible
- Difficulty level
- Hard (possibly days)
Hm, as ipt-netflow is actually a firewall target, it looks like it's configuration logic should be slightly different from pmacct's one.
Looks like there should be some service level config tree, specifying module load parameters, like
set service ipt-netflow collector 10.2.3.4 ...
and some firewall-level additional target, e.g.
set firewall name blabla rule 123 action 'NETFLOW'
I think we can choose how to implement it. We can apply it as a default entry in one of the vyos chains or let the user-decide. The advantage with the latter is that both implementations can co-exist for a while. With the former solution I would remove the old implementation to not confuse the user.
Well, I take vyos-kernel, iptables, build them in packages directory, and put ipt-netflow from here: https://github.com/mickvav/ipt-netflow-code as git submodule in the same packages directory, build it there and get working .deb package containing module, crafted for current vyos kernel. I have no CLI integration for it though I use my own firewall-messing scripts. But in general, you jest have to do modprobe the module with right parameters (where to send collected data) and add somewhere in firewall the rule with "-j NETFLOW" to trigger, which packets to take into account.
Well, I don't have access to development vm, where I did this stuff today (remind me on monday, please), but I do have kernel module (the only file in .deb, actually) compiled against 4.4.15-amd64-vyos kernel.
You have to put it in /lib/modules/4.4.15-amd64-vyos/extra/ directory and run depmod after.
But be ware - use at your own risk!
It looks like you have this compiled to much newer kernel, 4.4.15 while current kernel in VyOS 1.1.7 is 3.13.11-1-amd64-vyos.
So it looks like i need to compile it by my own, but thanks anyway for sharing this ;)