From owner-freebsd-net@freebsd.org Fri Jan 20 21:17:35 2017 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6F713CBA114 for ; Fri, 20 Jan 2017 21:17:35 +0000 (UTC) (envelope-from bakul@bitblocks.com) Received: from mail.bitblocks.com (ns1.bitblocks.com [173.228.5.8]) by mx1.freebsd.org (Postfix) with ESMTP id 543A91E11; Fri, 20 Jan 2017 21:17:34 +0000 (UTC) (envelope-from bakul@bitblocks.com) Received: from bitblocks.com (localhost [127.0.0.1]) by mail.bitblocks.com (Postfix) with ESMTP id 488D8124AEA5; Fri, 20 Jan 2017 13:17:34 -0800 (PST) To: =?UTF-8?Q?Ermal_Lu=C3=A7i?= cc: FreeBSD Net , Alan Somers Subject: Re: pf & NAT issue In-reply-to: Your message of "Fri, 20 Jan 2017 13:12:07 PST." References: <20170120083555.ACCF9124AEA4@mail.bitblocks.com> <7C29D00C-94C0-4550-B1B2-CE307482B544@FreeBSD.org> <20170120203106.CD2C8124AEA4@mail.bitblocks.com> <20170120205933.8948A124AEA3@mail.bitblocks.com> Comments: In-reply-to =?UTF-8?Q?Ermal_Lu=C3=A7i?= message dated "Fri, 20 Jan 2017 13:12:07 -0800." Date: Fri, 20 Jan 2017 13:17:34 -0800 From: Bakul Shah Message-Id: <20170120211734.488D8124AEA5@mail.bitblocks.com> X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 21:17:35 -0000 On Fri, 20 Jan 2017 13:12:07 PST =?UTF-8?Q?Ermal_Lu=C3=A7i?= wrote: > --001a1148cecc40685805468d1ad2 > Content-Type: text/plain; charset=UTF-8 > > On Fri, Jan 20, 2017 at 12:59 PM, Bakul Shah wrote: > > > On Fri, 20 Jan 2017 21:43:33 +0100 "Kristof Provost" > > wrote: > > > On 20 Jan 2017, at 21:31, Bakul Shah wrote: > > > >> 11:56:28.168693 IP 192.168.125.7.65042 > 149.20.1.200.21: Flags [P.], > > > >> seq 1:10, ack 55, win 1026, options [nop,nop,TS val 198426 ecr > > > >> 1468113725], length 9 > > > > < 11:56:28.168712 IP 173.228.5.8.52015 > 149.20.1.200.21: Flags [P.], > > > > seq 3080825147:3080825156, ack 3912707414, win 1026, options > > > > [nop,nop,TS val 198426 ecr 1468113725], length 9 > > > > > > > > Right here we see the problem. NAT mapping for the > > > > port changed from 63716 to 52015. > > > > > > > Changing source ports is an entirely normal NAT behaviour. > > > > > > The best explanation is this: imagine that you have two clients A and B, > > > both connect to X on port 80 via the NAT gateway G. > > > Both use port 1000 as their source port. > > > A connects, and the gateway maps A:1000 -> X:80 to G:1000 -> X:80. > > > B connects, and now the gateway has to map B:1000 -> X:80 onto G:1000 -> > > > X:80, but then it wouldn't be able to tell the two connections apart. > > > That't can remap it onto G:1001 -> X:80 instead. > > > > It is the same connection! As a tcp connection is identified > > by , If the port number > > changes on the same connection, the remote side would see this > > as a separate connection. > > > > Most probably your timeouts are aggressive on states garbage collection. > Give a look to those state limit teardown it might improve things. $ pfctl -s timeout tcp.first 120s tcp.opening 30s tcp.established 86400s tcp.closing 900s tcp.finwait 45s tcp.closed 90s tcp.tsdiff 30s udp.first 60s udp.single 30s udp.multiple 60s icmp.first 20s icmp.error 10s other.first 60s other.single 30s other.multiple 60s frag 30s interval 10s adaptive.start 6000 states adaptive.end 12000 states src.track 30s local port num changed after 23 seconds. All the tcp.* timeouts seem ok. IIRC internal is used for IP frags. Thanks Bakul