Please help if you got any idea what this problem is! :)

I have a Gentoo firewall setup on a Fujitsu-Siemens server with 2 SCSI HDs, dual P3 700. Have used two intel e100 network cards, alternatet with a netflex compaq server card (tlan driver).

The problem: Packet loss on my internet connection. When I ping out of the firewall I get around 10% packet loss. Also I tried to ping in from an external host, the same result. I ssh'd to an external gentoo I got placed another place and did the following command:

traceroute 217.199.46.18 -q 20 (trace my IP with 20 pings pr. host)

And the results are low ping times for all hops exept the last wich gets at least 3 drops of the 20, and this result is allways reproducable. Here is a printout example..:

5 217.199.46.18 (217.199.46.18) 17.744 ms 14.149 ms 14.835 ms 16.347 ms 15.416 ms 12.104 ms * 16.156 ms 13.029 ms 14.844 ms 12.264 ms 13.479 ms * * 19.405 ms 16.257 ms * 13.217 ms 12.447 ms 15.738 ms

All the * are timeouts. All the rest of the hops (1-4) har no stars. :)

Now.. I tried alot of things. This is a firewall so I just flushed all the iptables rules, removed the internal network card and just basically used the machine as a standalone computer. Same thing still happens. Tried to change the network card (e100 <-> tlan) but no diffrence.

To make sure it was the firewall that was making the problem I used a portable computer (Windows XP) and plugged that to the internet connection. When I pinged the GW IP then I got no loss whatsoever. So then I am pretty sure the firewall is the problem.

dmesg gives no errors, nothing obvious in the syslog, no cpu bottleneck, no memory out.

Also I tried to change the network cable to see if that could be the problem, but still no luck.

The strangest thing of all is that when I ping internal computers on the LAN I get no packet loss. But when I ping 1 hop, ergo the default gw of the firewall I get 6% packet loss.

The eksternal interface is hooked up to a nortel switch from the ISP. This switch does not autoneg so I have to force my network card into 10baseT-FD with module parameters or mii-tool. All this seems to work just fine.

Also I tried the ping flood tool (ping -f) to ping my default gateway. I get 7-8 dots not deleted pr second. This is crazy.