Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 18 Dec 2007 11:44:21 -0800
From:      "Kian Mohageri" <kian.mohageri@gmail.com>
To:        "Silver Salonen" <silver.salonen@gmail.com>
Cc:        freebsd-pf@freebsd.org
Subject:   Re: occasional "Operation not permitted" on state-mismatch
Message-ID:  <fee88ee40712181144g55727367gf333e44c537d0b47@mail.gmail.com>
In-Reply-To: <200712180934.58755.silver.salonen@gmail.com>
References:  <200712180934.58755.silver.salonen@gmail.com>

next in thread | previous in thread | raw e-mail | index | archive | help
On Dec 17, 2007 11:34 PM, Silver Salonen <silver.salonen@gmail.com> wrote:
> Hello!
>
> I have some FreeBSD-boxes (2x6.3-PRERELEASE (installed on 08.Dec),
> 1x6.2-RELEASE) with PF configured. They are connected with OpenVPN LAN-to-LAN
> and the problem is that a few times per hour connection drops between
> computers from one LAN to another. At first I blamed OpenVPN, then I blamed
> bridge, but now I've realized that the problem is in PF.
> So I've tried increasing TCP-timeouts and setting optimization
> to "aggressive", but well, it's still the same.
>
> I monitor connections by sending TCP packets once per second to some other
> host and wait for reply. I use Nagios-plugins' check_tcp for that. The script
> looks like:
> =====
> while [ 1 ]; do
>         pfctl -si |grep mismatch
>         /usr/local/libexec/nagios/check_tcp -H $host -p $port -t 2
>         pfctl -si |grep mismatch
>         sleep 1
> done
> =====
>

My guess is that you're re-using a source port and are mismatching an
existing state on the source or destination host (or something in
between) because the state hasn't expired before the new connection
attempt takes place.

Can't be sure though...

-Kian



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?fee88ee40712181144g55727367gf333e44c537d0b47>