From owner-freebsd-net@freebsd.org Mon Dec 5 15:00:51 2016 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B2CE4C68831; Mon, 5 Dec 2016 15:00:51 +0000 (UTC) (envelope-from cross+freebsd@distal.com) Received: from hydra.pix.net (hydra.pix.net [IPv6:2001:470:e254:11::4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.pix.net", Issuer "Pix.Com Technologies LLC CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 6749C105B; Mon, 5 Dec 2016 15:00:51 +0000 (UTC) (envelope-from cross+freebsd@distal.com) Received: from mail.distal.com (mail.distal.com [IPv6:2001:470:e24c:200:0:0:0:ae25]) (authenticated bits=0) by hydra.pix.net (8.16.0.19/8.15.2) with ESMTPSA id uB5F0g7w064708 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 5 Dec 2016 10:00:49 -0500 (EST) (envelope-from cross+freebsd@distal.com) Received: from [IPv6:2001:420:2710:1330:1c50:4fac:e56a:5aab] ([IPv6:2001:420:2710:1330:1c50:4fac:e56a:5aab]) (authenticated bits=0) by mail.distal.com (8.15.2/8.15.2) with ESMTPSA id uB5F0cfU044602 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 5 Dec 2016 10:00:39 -0500 (EST) (envelope-from cross+freebsd@distal.com) From: Chris Ross Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Subject: Problems with FreeBSD (amd64 stable/11) router Date: Mon, 5 Dec 2016 10:00:33 -0500 Message-Id: <619F01C2-5A20-4E25-AB0B-4064B598239D@distal.com> Cc: Chris Ross To: freebsd-net@freebsd.org, freebsd-pf@freebsd.org Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 15:00:51 -0000 Hello all. I recently replaced my router with a FreeBSD/11 box = (stable/11 r308579). I am running a lagg device across two bce=E2=80=99s,= and 802.1q vlan interfaces atop lagg0. I=E2=80=99m using pf to = NAT/filter out through a single outside IP address. I=E2=80=99m having the following problem. Some devices appear to be = having trouble passing traffic. Of course, I first assumed I was doing = something wrong with my pf filters, but I believe now that=E2=80=99s not = the problem. One client machine (a TiVo Roamio) that produces a failure = reliably, so I=E2=80=99ve been using it for testing, is showing that = during a TCP session, which starts up fine, in the middle of a POST = operation to an outside server, there are 1500 byte packets. These = packets have the DF bit in the IP header, and then never show up on the = external interface (vlan0). Smaller packets in the same TCP stream do. = But, I=E2=80=99m also not seeing the ICMP from the router back to the = client telling it that it cannot send the packet. I have tried all sorts of changes to my pf rules, including now = allowing all ICMP unconditionally on all interfaces (pass out log quick = inet proto icmp all). I have packet traces during the failed = communication across pflog0, vlan0 (external network) and vlan7 = (internal network). I=E2=80=99d be happy to answer any questions, or = provide the traces off-list. Does anyone have any idea what I=E2=80=99ve missed? Thank you very = much for your help. - Chris