From owner-freebsd-pf@FreeBSD.ORG Thu Mar 18 20:38:02 2010 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BB561106566C; Thu, 18 Mar 2010 20:38:02 +0000 (UTC) (envelope-from auryn@zirakzigil.org) Received: from mail.zirakzigil.org (mail.zirakzigil.org [82.63.178.63]) by mx1.freebsd.org (Postfix) with ESMTP id 5C3798FC1E; Thu, 18 Mar 2010 20:38:02 +0000 (UTC) Received: from localhost (unknown [192.168.1.2]) by mail.zirakzigil.org (Postfix) with ESMTP id E1D2894D7B; Thu, 18 Mar 2010 21:38:00 +0100 (CET) X-Virus-Scanned: amavisd-new at zirakzigil.org Received: from mail.zirakzigil.org ([192.168.1.2]) by localhost (ext.zirakzigil.org [192.168.1.2]) (amavisd-new, port 10024) with ESMTP id RkWFll9hwuAi; Thu, 18 Mar 2010 21:37:57 +0100 (CET) Received: from aurynmob2.giulioferro.it (unknown [192.168.1.2]) (Authenticated sender: auryn@zirakzigil.org) by mail.zirakzigil.org (Postfix) with ESMTPA id E5EFA94D71; Thu, 18 Mar 2010 21:37:56 +0100 (CET) Message-ID: <4BA28F22.6080401@zirakzigil.org> Date: Thu, 18 Mar 2010 21:37:54 +0100 From: Giulio Ferro User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US; rv:1.9.1.7) Gecko/20100223 Thunderbird/3.0.1 MIME-Version: 1.0 To: Max Laier References: <4B8E4850.1060104@zirakzigil.org> <201003181526.00442.max@love2party.net> <4BA25741.6070007@zirakzigil.org> <201003182035.56363.max@love2party.net> In-Reply-To: <201003182035.56363.max@love2party.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-net@freebsd.org, Greg Hennessy , freebsd-pf@freebsd.org Subject: Re: PF + BRIDGE + PFSYNC causes system freezing X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 20:38:02 -0000 On 18.03.2010 20:35, Max Laier wrote: > Okay ... so it looks like this is a live lock (not a deadlock) and it's > probably caused by relooping packets. Now we "only" have to find the culprit > for the loop ... > > can you share your setup details, again? The simpler the better. > > Ok > uname -a FreeBSD firewall-1.acme.com 8.0-STABLE FreeBSD 8.0-STABLE #2: Thu Mar 18 15:59:27 CET 2010 root@acme.com:/usr/obj/usr/src/sys/FIREWALL amd64 > cat /etc/sysctl.conf net.inet.ip.forwarding=1 net.inet.ip.fastforwarding=1 net.inet.carp.preempt=1 Services running : sshd, named, inetd, ntpd, openvpn (tap), racoon, pptp, asterisk 2 physical interfaces : bce0, bce1 11 vlan interfaces : vlan1, ..., vlan11 (vlandev bce1) 11 carp interfaces ; carp1, ..., carp11 (carp1 has 23 alias addresses) 1 bridge interfaces : bridge0 addm vlan35 (used by openvpn) 2 gif interfaces : gif0, gif1 (racoon / IPSEC) 8 static routes pf packet filter : 12 rdr rules, 3 nat rules, set skip{lo0, bridge0}, 4 pass quick, block log all, about 30 pass keep state This should be all. I'm available for any test / patch... Thanks.