From owner-freebsd-pf@FreeBSD.ORG Tue Apr 3 16:12:22 2007 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id EE0B116A404 for ; Tue, 3 Apr 2007 16:12:21 +0000 (UTC) (envelope-from max@love2party.net) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.187]) by mx1.freebsd.org (Postfix) with ESMTP id 84AEA13C45E for ; Tue, 3 Apr 2007 16:12:19 +0000 (UTC) (envelope-from max@love2party.net) Received: from [88.66.51.80] (helo=amd64.laiers.local) by mrelayeu.kundenserver.de (node=mrelayeu8) with ESMTP (Nemesis), id 0ML31I-1HYlc92TEE-00067v; Tue, 03 Apr 2007 18:12:15 +0200 From: Max Laier Organization: FreeBSD To: freebsd-pf@freebsd.org Date: Tue, 3 Apr 2007 17:11:54 +0100 User-Agent: KMail/1.9.5 References: <46117263.3060203@mykitchentable.net> In-Reply-To: <46117263.3060203@mykitchentable.net> X-Face: ,,8R(x[kmU]tKN@>gtH1yQE4aslGdu+2]; R]*pL,U>^H?)gW@49@wdJ`H<=?utf-8?q?=25=7D*=5FBD=0A=09U=5For=3D=5CmOZf764=26nYj=3DJYbR1PW0ud?=>|!~,,CPC.1-D$FG@0h3#'5"k{V]a~.<=?utf-8?q?mZ=7D44=23Se=7Em=0A=09Fe=7E=5C=5DX5B=5D=5Fxj?=(ykz9QKMw_l0C2AQ]}Ym8)fU MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart23052544.sQyGFVaqnU"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200704031812.00089.max@love2party.net> X-Provags-ID: V01U2FsdGVkX1+9DpMD60HI6ChxjChWOfZR7Dscti4jBuGP9U5 jFAumcWfR80TNCg9eZtchbT0pfVmUUQFnMIa5z047VLD+h3SES rZPiYYyWA9bnpfTuVJVDw== Cc: Subject: Re: Bacula and pf X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Apr 2007 16:12:22 -0000 --nextPart23052544.sQyGFVaqnU Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Monday 02 April 2007 23:15, Drew Tomlinson wrote: > I run Bacula v1.38 on my home network. Ever since I moved from ipfw2 > to pf, backups fail intermittently on my router due to "broken network > pipes" usually after somewhere around 10 MB - 12 MB has been > transfered. Thus small incremental backups are successful but larger > full backups are not. I do not have this problem when I disable pf on > the router, nor do I have problems when completing backups with other > machines on my internal network. My setup looks like this: > > bacula director --------- router (client) > 192.168.1.4 (fxp0) 192.168.1.2 (dc0) > > Communication takes place on ports 9102 and 9103. I captured this > output from pflog0 after starting a backup: > > blacksheep# tcpdump -netttti pflog0 "( host blacksheep or blacklamb ) > and ( port 9102 or port 9103 )" > tcpdump: WARNING: pflog0: no IPv4 address assigned > tcpdump: verbose output suppressed, use -v or -vv for full protocol > decode listening on pflog0, link-type PFLOG (OpenBSD pflog file), > capture size 96 bytes > 2007-04-02 13:57:21.021122 rule 7/0(match): pass in on dc0: > 192.168.1.4.52295 > 192.168.1.2.9102: S 2822997678:2822997678(0) win > 65535 > 2007-04-02 13:57:23.532037 rule 13/0(match): pass out on dc0: > 192.168.1.2.64955 > 192.168.1.4.9103: S 2265048451:2265048451(0) win > 65535 > 2007-04-02 13:57:23.532323 rule 7/0(match): pass in on dc0: > 192.168.1.4.9103 > 192.168.1.2.64955: S 3452777266:3452777266(0) ack > 2265048452 win 65535 > > And the rules are: > > @7 pass in log on dc0 inet proto tcp from 192.168.1.0/24 to any > modulate state queue(std_out, ack_out) This rule should have "flags S/SA" on it. > @13 pass out log on dc0 inet all > > Any ideas why Bacula would have such a problem? Other things to check? Can you turn on pf debugging via "pfctl -xm" and watch the console while=20 doing the backup? Also monitor "pfctl -si" for increasing counters -=20 esp. state-mismatch. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart23052544.sQyGFVaqnU Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) iD4DBQBGEnzQXyyEoT62BG0RAoEHAJ0XsrugQv3pBwxKpC/axur2R12+tACYtoWI uXPtA0pcN0E84FuZdaBEZQ== =A6Rr -----END PGP SIGNATURE----- --nextPart23052544.sQyGFVaqnU--