Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 3 Apr 2007 17:11:54 +0100
From:      Max Laier <max@love2party.net>
To:        freebsd-pf@freebsd.org
Subject:   Re: Bacula and pf
Message-ID:  <200704031812.00089.max@love2party.net>
In-Reply-To: <46117263.3060203@mykitchentable.net>
References:  <46117263.3060203@mykitchentable.net>

next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart23052544.sQyGFVaqnU
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Monday 02 April 2007 23:15, Drew Tomlinson wrote:
> I run Bacula v1.38 on my home network.  Ever since I moved from ipfw2
> to pf, backups fail intermittently on my router due to "broken network
> pipes" usually after somewhere around 10 MB - 12 MB has been
> transfered.  Thus small incremental backups are successful but larger
> full backups are not.  I do not have this problem when I disable pf on
> the router, nor do I have problems when completing backups with other
> machines on my internal network.  My setup looks like this:
>
> bacula director --------- router (client)
> 192.168.1.4 (fxp0)        192.168.1.2 (dc0)
>
> Communication takes place on ports 9102 and 9103.  I captured this
> output from pflog0 after starting a backup:
>
> blacksheep# tcpdump -netttti pflog0 "( host blacksheep or blacklamb )
> and ( port 9102 or port 9103 )"
> tcpdump: WARNING: pflog0: no IPv4 address assigned
> tcpdump: verbose output suppressed, use -v or -vv for full protocol
> decode listening on pflog0, link-type PFLOG (OpenBSD pflog file),
> capture size 96 bytes
> 2007-04-02 13:57:21.021122 rule 7/0(match): pass in on dc0:
> 192.168.1.4.52295 > 192.168.1.2.9102: S 2822997678:2822997678(0) win
> 65535 <mss 1460,nop,wscale 1,[|tcp]>
> 2007-04-02 13:57:23.532037 rule 13/0(match): pass out on dc0:
> 192.168.1.2.64955 > 192.168.1.4.9103: S 2265048451:2265048451(0) win
> 65535 <mss 1460,nop,wscale 1,[|tcp]>
> 2007-04-02 13:57:23.532323 rule 7/0(match): pass in on dc0:
> 192.168.1.4.9103 > 192.168.1.2.64955: S 3452777266:3452777266(0) ack
> 2265048452 win 65535 <mss 1460,nop,wscale 1,[|tcp]>
>
> And the rules are:
>
> @7 pass in log on dc0 inet proto tcp from 192.168.1.0/24 to any
> modulate state queue(std_out, ack_out)

This rule should have "flags S/SA" on it.

> @13 pass out log on dc0 inet all
>
> Any ideas why Bacula would have such a problem?  Other things to check?

Can you turn on pf debugging via "pfctl -xm" and watch the console while=20
doing the backup?  Also monitor "pfctl -si" for increasing counters -=20
esp. state-mismatch.

=2D-=20
/"\  Best regards,                      | mlaier@freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier@EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News

--nextPart23052544.sQyGFVaqnU
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (FreeBSD)

iD4DBQBGEnzQXyyEoT62BG0RAoEHAJ0XsrugQv3pBwxKpC/axur2R12+tACYtoWI
uXPtA0pcN0E84FuZdaBEZQ==
=A6Rr
-----END PGP SIGNATURE-----

--nextPart23052544.sQyGFVaqnU--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200704031812.00089.max>