Date: Tue, 17 Feb 2009 18:24:39 +0100 From: n j <nino80@gmail.com> To: freebsd-ipfw@freebsd.org Subject: Re: in-kernel nat and stateful inspection hangs system 7.1 RELEASE Message-ID: <92bcbda50902170924h167125f2vf054ffd481ec1831@mail.gmail.com> In-Reply-To: <1d3a1860902161412w2225734do71939efd32346a23@mail.gmail.com> References: <1d3a1860902160108j372b4446pd21760984d253627@mail.gmail.com> <200902161428.n1GESLvL015103@lurza.secnetix.de> <1d3a1860902161412w2225734do71939efd32346a23@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> About 2 Minutes later after apply this rule set, system writes that bge1 > watchdog timeout --- resetting and then system hangs, keyboard doesnt > response. No logs can be observed. > > When i remove all skipto and checkstate rules, system work properly > without problems. I suspect about stateful inpection code. Just to add a "me too" message to this thread, I also experienced system freezes (keyboard not working => hardware reset necessary) with in-kernel NAT and stateful rules. I had a repeatable case on a production server and hoped to replicate the bug on a different machine as the production server needed to go in, well, production; however thanks to complex setup of original machine (in-kernel NAT, vlans, openvpn...), lack of time and virtual environment, test scenario failed to produce a sensible bug report and I gave up until I saw OP reporting the same issue. Here is the rule that after a short while (probably the first packet to match the rule) freezes the machine: ipfw 00003 nat 123 log ip from x.x.x.0/24 to a.b.c.0/24,a.b.d.0/24,a.b.e.0/24 out # keep-state here causes freeze ... further down the chain... ipfw I know this is far from a good bug report, but stateful inspection code/in-kernel NAT mix might be worth looking into.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?92bcbda50902170924h167125f2vf054ffd481ec1831>