RT-AC87U and Merlin 376.44 hardware acceleration and custom iptable rules

[Ronv42]

I have my RT-AC87U in a very basic configuration. No QOS, some inbound ports open and IP Reporting from clients turned on and a couple of custom iptable rules to forward traffic to my Squid proxy server.

Tonight I was fiddling around in the system status and it said that hardware acceleration was off due to the IP Traffic Reporting. So I deiced to turn it off and see if there was a difference in performance both from traffic and from the amount of CPU utilized by he router.

I rebooted the router after turning off the IP Traffic reporting and my rules for forwarding to the proxy were no longer working. In fact they were taking me to the router status page for every url I used in a browser.

I manually turned off hardware acceleration for NAT and the rules worked again. So I question if there is some commands in the nat tables that no longer function with hardware acceleration? Here are my two statements I have been using for forwarding to the proxy:

iptables -t nat -A PREROUTING -i br0 ! -s 192.168.10.253 -p tcp --dport 80 -j DNAT --to 192.168.10.253:3128
iptables -t nat -A POSTROUTING -o br0 -s 192.168.10.0/24 -d 192.168.10.253 -j SNAT --to 192.168.10.252

 

[RMerlin]

HW acceleration bypasses parts of Netfilter, including the FORWARD chain.

 

[Ronv42]

HW acceleration bypasses parts of Netfilter, including the FORWARD chain.

Thanks I was not aware of all the elements that HW acceleration effected. From my perspective I would rather have the flexibility of Netfilter vs. HW acceleration.

Has Asus provided any technical documentation of HW acceleration implementation?

 

[RMerlin]

Thanks I was not aware of all the elements that HW acceleration effected. From my perspective I would rather have the flexibility of Netfilter vs. HW acceleration.

Has Asus provided any technical documentation of HW acceleration implementation?

No. It's proprietary Broadcom technology - not even Asus has the source code to that module.

 

[ericbergan]

HW acceleration bypasses parts of Netfilter, including the FORWARD chain.

Wow - good to know! So is the HW acceleration implementing the default FORWARD chain? Is it doing logaccept/logdrop? Thanks!

 

[RMerlin]

Wow - good to know! So is the HW acceleration implementing the default FORWARD chain? Is it doing logaccept/logdrop? Thanks!

No one knows the details, since it's closed source, and Broadcom ain't sharing.