Date: Fri, 18 May 2012 12:56:18 +0200 From: =?ISO-8859-1?Q?Ermal_Lu=E7i?= <eri@freebsd.org> To: Adam Strohl <adams-freebsd@ateamsystems.com> Cc: freebsd-pf@freebsd.org Subject: Re: PF "synproxy state" doesn't work on CARP IPs Message-ID: <CAPBZQG2qwOzwjFiMnLCfrRJ_R9Bh2sA6WnoLyW0L9-vJ_=nMHw@mail.gmail.com> In-Reply-To: <4FB39A69.2030706@ateamsystems.com> References: <4FB39A69.2030706@ateamsystems.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, May 16, 2012 at 2:15 PM, Adam Strohl <adams-freebsd@ateamsystems.com> wrote: > Hello, > > I've noticed that when I use "synproxy state" on a rule and a connection > comes in to an IP on a CARP interface the connection opens but never gets > passed on to the process as it should. > > For example: > > pass in on $ext_if proto tcp from any to any port ssh flags S/SA synproxy > state > > Will work fine if I come in to a non-CARP IP. =A0The connection is accept= ed > and then brokered to SSHd. > > However on the same machine with the same rule if I come in to a CARP'd I= P > it connects but hangs (not passed on to SSHd). > > If I remove the "synproxy state" portion the CARP test case works. > > I've done a bunch of flipping and testing and it seems that CARP IP + PF > rule with "synproxy state" doesn't work -- the connection will be accepte= d > but not passed on like it should. > > Is this known behaviour? =A0Is there a work around? =A0Anything else anyo= ne > wants to know? > Yeah its known behaviour though i am not sure there is a PR related to it. I might have a solution but not sure when i can produce a patch for this. Which FreeBSD version are you on, i thought that with carp(4) rearangment of not using ifnets this solved itself? > I've noticed this too: the physical interface seems to "include" the CARP > interfaces associated with it. =A0That above rule I pasted applies to the= CARP > interface even though its specifying "bce0" as the value for $ext_if (vs.= a > rule for "carp1", etc) Is that normal/expected? > > I did notice in the docs that "synproxy state" doesn't work with bridge > interfaces, is a CARP interface maybe falling into this category? > > Any input/thoughts appreciated! > > P.S. > Please be sure to CC me, I am not subscribed to the PF mailing list. > > -- > > Adam Strohl > A-Team Systems > http://ateamsystems.com/ > > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org" --=20 Ermal
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAPBZQG2qwOzwjFiMnLCfrRJ_R9Bh2sA6WnoLyW0L9-vJ_=nMHw>