Date: Sun, 11 Sep 2011 19:35:23 -0700 (PDT) From: Ping Mai <pingmai@yahoo.com> To: "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org> Subject: pf slow connect on smtp Message-ID: <1315794923.94330.YahooMailNeo@web121718.mail.ne1.yahoo.com> In-Reply-To: <1315780040.76570.YahooMailNeo@web121719.mail.ne1.yahoo.com> References: <1315780040.76570.YahooMailNeo@web121719.mail.ne1.yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
added this line at the end and incoming smtp is working on both external in=
terfaces:=0A=0Apass in quick on $dsl_if reply-to ($dsl_if $dsl_gw ) flags S=
/SA keep state=0A=0A=0A=0A________________________________=0AFrom: Ping Mai=
<pingmai@yahoo.com>=0ATo: "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org=
>=0ASent: Sunday, September 11, 2011 3:27 PM=0ASubject: slow=0A=0A=0AHi, =
=0A=0AI'm new to pf.=A0 hoping for some help with pf.conf.=0A=0AFreeBSD 5.5=
router.=A0 2 external interfaces, $com_if and $dsl_if.=A0 The default rout=
e is set to $com_if.=0A=0Aincoming smtp to $com_if seems to work fine.=0A=
=0A=0Aincoming smtp to $dsl_if is the problem.=A0 connect to tcp/25 is fast=
.=A0 but after I issue a 'ehlo ...'=A0 there's a delay of ~1 minute before =
the reply comes back.=A0 from that point on the exchange works just fine.=
=0AThe problem is most MTA don't wait that long.=A0 they simply drop the co=
nnection.=0A=0Atcpdump of pflog0 sees the incoming tcp/25, outgoing from tc=
p/25 gets routed to $dsl_if (dc3).=A0 after that, looks like it does an 'id=
ent' and a DNS lookup. then it just sits there for minutes.=0A=0Awhat's wro=
ng with my pf.conf?=0A=0A#----------------- tcpdump ------------------=0A=
=0A000000 rule 16/0(match): pass in on dc3: IP 100.100.100.153.63225 > 12.3=
4.56.40.25: S 743439640:743439640(0) win 65535 <mss 1460,nop,wscale 3,[|tcp=
]>=0A000083 rule 28/0(match): pass out on dc0: IP 12.34.56.40.25 > 100.100.=
100.153.63225: S 2206509942:2206509942(0) ack 743439641 win 65535 <mss 1460=
,nop,wscale 1,[|tcp]>=0A000023 rule 12/0(match): pass out on dc3: IP 12.34.=
56.40.25 > 100.100.100.153.63225: S 2206509942:2206509942(0) ack 743439641 =
win 65535 <mss 1460,nop,wscale 1,[|tcp]>=0A080881 rule 28/0(match): pass ou=
t on dc0: IP 12.34.56.40.64647 > 100.100.100.153.113: S 1468481550:14684815=
50(0) win 65535 <mss 1460,nop,nop,sackOK,[|tcp]>=0A000027 rule 12/0(match):=
pass out on dc3: IP 12.34.56.40.64647 > 100.100.100.153.113: S 1468481550:=
1468481550(0) win 65535 <mss=0A 1460,nop,nop,sackOK,[|tcp]>=0A082959 rule 1=
3/0(match): pass out on dc0: IP 23.45.67.51.62568 > 23.45.57.182.53:=A0 503=
36+ [1au][|domain]=A0 =0A=0A#------------------ pf.conf -------------------=
-----------------------------------=0Aint_if =3D "dc1"=0A=0Adsl_if =3D "dc3=
"=0Acom_if =3D "dc0"=0Admz_if =3D "dc2"=0Aint_net =3D "10.1.100.0/24"=0Admz=
_net =3D "10.1.101.0/24"=0Adsl_gw=3D"12.34.56.1"=0A=0Acom_gw=3D"23.45.67.1"=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 # default rout=
e=0A=0Aiserver=3D"10.1.100.99"=0A=0Atcp_services=3D"{ http https }"=0A=0Aic=
mp_types=3D"echoreq"=0A=0Atable <internal> { $int_net, $dmz_net }=0A=0Aset =
loginterface $dsl_if=0Aset loginterface $com_if=0Aset optimization normal=
=0Aset block-policy return=0Aset require-order yes=0A=0A=0Ascrub in all=0An=
at on $dsl_if from <internal> -> $dsl_if=0Anat on $com_if from <internal> -=
> $com_if=0A=0Ardr pass on $dsl_if proto tcp from any to $dsl_if port $tcp_=
services -> $iserver=0Ardr pass on $com_if proto tcp from any to $com_if=0A=
port $tcp_services -> $iserver=0A=0Ablock out log all=0Ablock in log all=
=0Apass quick on lo0=0A=0Aantispoof quick for { lo0 $dsl_if $com_if $dmz_if=
$int_if}=0A=0Apass out log on $dsl_if=0Apass out log on $com_if=0A=0Apass =
log on $int_if keep state=0Apass log on $dmz_if from any to ! $int_if:netwo=
rk keep state=0A=0Apass in log on $dsl_if proto tcp to $dsl_if port { smtp,=
smtps }=0Apass in log on $com_if proto tcp to $com_if port { smtp, smtps }=
=0Apass in on $dsl_if proto { tcp, udp } to $dsl_if port {domain}=0Apass in=
on $com_if proto { tcp, udp } to $com_if port {domain}=0Apass in on $com_i=
f proto { tcp, udp } to port {bootpc}=0A=0Apass in inet proto icmp all icmp=
-type $icmp_types=0A=0Apass out log on $dsl_if route-to ($com_if $com_gw) f=
rom $com_if=0Apass out log on $com_if route-to ($dsl_if $dsl_gw) from=0A $d=
sl_if=0A#------------------------------------------------------------------=
------
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1315794923.94330.YahooMailNeo>