From owner-freebsd-pf@FreeBSD.ORG Wed Jan 1 19:16:36 2014 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 7513162C; Wed, 1 Jan 2014 19:16:36 +0000 (UTC) Received: from sasl.smtp.pobox.com (a-pb-sasl-quonix.pobox.com [208.72.237.25]) by mx1.freebsd.org (Postfix) with ESMTP id 2A7C71DA0; Wed, 1 Jan 2014 19:16:35 +0000 (UTC) Received: from sasl.smtp.pobox.com (unknown [127.0.0.1]) by a-pb-sasl-quonix.pobox.com (Postfix) with ESMTP id 29D01ECFF; Wed, 1 Jan 2014 14:16:29 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=pobox.com; h=date :message-id:from:to:cc:subject:in-reply-to:references :mime-version:content-type:content-transfer-encoding; s=sasl; bh=XK2V2WKa+AhmN1Jw6V1jX/7Pq8M=; b=Kt16B2KgEtRdRRMvxIIMLxVYR+er RiLEs1r8PVKSugEnC+u5Xv/j83mdkJeIHVrSEtykGVlm5Gmgx1VET1QZjIpVKqlD k1S5gw2DNq4BZ5kS7osrOxfoQFr0z/flN4HoOzoMvvefwDWDPPqhArr/cbMNcJLB zjePVU4e8AJXWXA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=pobox.com; h=date:message-id :from:to:cc:subject:in-reply-to:references:mime-version :content-type:content-transfer-encoding; q=dns; s=sasl; b=OBHfWN 9RdGqfpmwqhz1Ze1TXmmWx7uJ59D5FYr5/TTY2wooGyadN6Qtqw/W1SiWoez4Lzh LkN7QFM+HInavhrevQemNr2TWAVDf93PcQRBFeWX1eFzEhiH9eS0i6rBqxW/AHpS fm2VBPhFO2xBMKYx/8r2sMv360iC44aWUvQCg= Received: from a-pb-sasl-quonix.pobox.com (unknown [127.0.0.1]) by a-pb-sasl-quonix.pobox.com (Postfix) with ESMTP id 21D34ECFE; Wed, 1 Jan 2014 14:16:29 -0500 (EST) Received: from bmach.nederware.nl (unknown [27.252.227.148]) by a-pb-sasl-quonix.pobox.com (Postfix) with ESMTPA id 947E5ECFD; Wed, 1 Jan 2014 14:16:28 -0500 (EST) Received: from quadrio.nederware.nl (quadrio.nederware.nl [192.168.33.13]) by bmach.nederware.nl (Postfix) with ESMTP id 52C403100E; Thu, 2 Jan 2014 08:16:26 +1300 (NZDT) Received: from quadrio.nederware.nl (quadrio.nederware.nl [127.0.0.1]) by quadrio.nederware.nl (Postfix) with ESMTP id 1032D4A15EA7; Thu, 2 Jan 2014 08:16:26 +1300 (NZDT) Date: Thu, 02 Jan 2014 08:16:21 +1300 Message-ID: <87a9ffcy2i.wl%berend@pobox.com> From: Berend de Boer To: Gleb Smirnoff Subject: Re: Network severely unstable 10.0-PRERELEASE In-Reply-To: <20131230191327.GC71033@glebius.int.ru> References: <87sitku33x.wl%berend@pobox.com> <20131225132752.GK71033@FreeBSD.org> <877gasu3oa.wl%berend@pobox.com> <20131226153155.GS71033@glebius.int.ru> <87ob3zcavs.wl%berend@pobox.com> <20131230191327.GC71033@glebius.int.ru> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 EasyPG/1.0.0 Emacs/24.3 (i686-pc-linux-gnu) MULE/6.0 (HANACHIRUSATO) Organization: Xplain Technology Ltd MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: multipart/signed; boundary="pgp-sign-Multipart_Thu_Jan__2_08:16:20_2014-1"; micalg=pgp-sha256; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit X-Pobox-Relay-ID: 370BDD14-7319-11E3-8613-873F0E5B5709-48001098!a-pb-sasl-quonix.pobox.com Cc: freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jan 2014 19:16:36 -0000 --pgp-sign-Multipart_Thu_Jan__2_08:16:20_2014-1 Content-Type: text/plain; charset=US-ASCII >>>>> "Gleb" == Gleb Smirnoff writes: Gleb> Can you please try attached patch? I hope it'll fix the Gleb> panic. Have been running this without the rule change, to see if it doesn't introduce any adverse effects. So far so good. When I'm back from holiday (this Saturday), I'll enable the bad keyword. Gleb> No idea on how good will your rule work, however. I have no idea either! A bit harder to test, the goal was to make games/voip udp work a bit better without having to allocate ports. I think I could just write: nat on egress from any to any -> (egress) round-robin sticky-address instead of what I have now: nat pass on egress proto udp from any port $voip_ports to any -> (egress) static-port nat pass on egress from any to any -> (egress) sticky-address -- All the best, Berend de Boer --pgp-sign-Multipart_Thu_Jan__2_08:16:20_2014-1 Content-Type: application/pgp-signature Content-Transfer-Encoding: 7bit Content-Description: OpenPGP Digital Signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (GNU/Linux) iQIcBAABCAAGBQJSxGmEAAoJEKOfeD48G3g52UYP/1eiejLLHh1f10TG8WZi2v+l bhjbdgarV9PR5lMmHi6rkthB+RXuG2ogBZKVX4XAQ/zC4ezu/e83SwvfP44d7ymh /bepDCnKuo2i7NV28XfpI9TDBO84+MMNyMeHYX5oAjF1RN58qh31WvwfxVyJrqbM HmVh/ZUWS/XDDNWrobwG8Ko1GUMJYUFga5T0bHajT+fLVgn/woJbDfMshQEv6x0H P+sUkcAfJ1Dxu74xxBIG/4fzqw1F2dFn6drg1poUy5nU/GyYlNojpwkfQmip3LPc CY+6AVYq0gGsdJfu4ixkIYCNWj0UVmkPaMT+GrevlQ8thJEG+CjY3jyJeSLJS+/h /gz7wCBjAuv8t5Ikr54BX6Y6izH5E997yRkOIbp87DUCjwgo/Hy7L35tuLPnIeOz 0G9h1u8oDGErkeKppq46FQDf4cntWtsrR7IGi4vTZICGsDSbvtPmIkgD7yCSN1zS rToTCr4NzSuiyWfhjvNDu0caIFhntnquhMzhXaBdczU1W3s2DtDPqxTcXOSNMT/W wbpg1qY0FyExSbFlH6zC/X6LfP0qfd4C2mahM15umJC3yNFFvBSNuH6lw88ZgQFM oiGsAMiiBIUg46Jjro+a9NPctlegNdXY/A4Fpfrr2gfj+g4mIvg8P+NW0BbPgRdo z49I0+WU9XCYQ7sCzAMp =35ki -----END PGP SIGNATURE----- --pgp-sign-Multipart_Thu_Jan__2_08:16:20_2014-1--