From owner-freebsd-pf@FreeBSD.ORG  Tue Jul 29 10:10:52 2008
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id EAEF9106567A
	for <freebsd-pf@freebsd.org>; Tue, 29 Jul 2008 10:10:52 +0000 (UTC)
	(envelope-from jdc@parodius.com)
Received: from mx01.sc1.parodius.com (mx01.sc1.parodius.com [72.20.106.3])
	by mx1.freebsd.org (Postfix) with ESMTP id DFA668FC1F
	for <freebsd-pf@freebsd.org>; Tue, 29 Jul 2008 10:10:52 +0000 (UTC)
	(envelope-from jdc@parodius.com)
Received: by mx01.sc1.parodius.com (Postfix, from userid 1000)
	id 994E11CC0B2; Tue, 29 Jul 2008 03:10:52 -0700 (PDT)
Date: Tue, 29 Jul 2008 03:10:52 -0700
From: Jeremy Chadwick <koitsu@FreeBSD.org>
To: Nejc ?koberne <nejc@skoberne.net>
Message-ID: <20080729101052.GA65160@eos.sc1.parodius.com>
References: <488EE046.4010602@skoberne.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <488EE046.4010602@skoberne.net>
User-Agent: Mutt/1.5.18 (2008-05-17)
Cc: freebsd-pf@freebsd.org
Subject: Re: pf randomly blocks specific packets?
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Jul 2008 10:10:53 -0000

On Tue, Jul 29, 2008 at 11:17:58AM +0200, Nejc ?koberne wrote:
> I have a FreeBSD 7.0 system with jails (and services in them). In one of the jails there
> is an Apache server, which also runs on the host system (and forwards traffic using
> mod_proxy to the jailed Apache).
>
> Everything works as expected, I only have problems with pf which seems to block certain
> packets randomly (not all of them).
>
> {snip}

Does removing "reassemble tcp" from your scrub rules fix anything?

I cannot comment on the rest of the ruleset.

-- 
| Jeremy Chadwick                                jdc at parodius.com |
| Parodius Networking                       http://www.parodius.com/ |
| UNIX Systems Administrator                  Mountain View, CA, USA |
| Making life hard for others since 1977.              PGP: 4BD6C0CB |