Low performance on RB5009 with machine behind NAT

[AlexX9]

Why isn’t it bridged to the LAN it needs to examine instead?

The interface the server is connected to is part of the default LAN bridge, if that’s what you mean. I’m using defconf and have only enabled IPv6, added Hairpin NAT and some port forwards. If what you’re asking is why I don’t scan from within the same network then that’s because I have firewalls upstream, so that would not give me the correct results.

Because that decision can’t be made until after the first SYN is seen, where the default firewall applies the fasttrack-connection flag.

Yeah, that makes sense, so only the SYN-ACK package uses fast path. Thank you for the explanation.

This is one of many costs of running traffic through a firewall on the CPU instead of bridging it directly.

What do you mean by bridging it directly? I’d love if I could somehow speed up forwarding of theese packets.