From owner-freebsd-stable@FreeBSD.ORG Wed Mar 5 10:04:56 2008 Return-Path: Delivered-To: stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 834A31065672 for ; Wed, 5 Mar 2008 10:04:56 +0000 (UTC) (envelope-from jdc@parodius.com) Received: from mx01.sc1.parodius.com (mx01.sc1.parodius.com [72.20.106.3]) by mx1.freebsd.org (Postfix) with ESMTP id 6E57E8FC18 for ; Wed, 5 Mar 2008 10:04:56 +0000 (UTC) (envelope-from jdc@parodius.com) Received: by mx01.sc1.parodius.com (Postfix, from userid 1000) id 55D941CC033; Wed, 5 Mar 2008 02:04:56 -0800 (PST) Date: Wed, 5 Mar 2008 02:04:56 -0800 From: Jeremy Chadwick To: ????????? ????????? Message-ID: <20080305100456.GA20350@eos.sc1.parodius.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.16 (2007-06-09) Cc: stable@freebsd.org Subject: Re: Could Not open some sites from Windows Vista and Server 2008 when using FreeBSD as gw X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Mar 2008 10:04:56 -0000 On Wed, Mar 05, 2008 at 10:49:09AM +0200, ????????? ????????? wrote: > We are using FreeBSD as GateWay with PF. > And the problem is that some web-sites as Gmail.com or Msn.com are > unavailable from machines with Vista or Server 2008 installed. > If use external or internal proxy (Kerio WinRoute, wich also goes through > the same FreeBSD gw) they are opening correctly. > Also in 6.1 version were problems with skype from such machines. I doubt people will be able to help you without some hard details provided. Not that anyone is denying the problem exists, but there's no details that are helpful in your report. I'm willing to bet your pf rules are incorrect/broken; is NAT involved? You could also try turning off RFC1323 extensions, which has helped some people in the past: sysctl net.inet.tcp.rfc1323=0 To disable RFC1323 extensions permanently, put this in /etc/rc.conf: tcp_extensions="no" -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |