From nobody Tue Jun 4 15:37:55 2024 X-Original-To: freebsd-current@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4VtvrX63sjz5Ly9n for ; Tue, 04 Jun 2024 15:38:36 +0000 (UTC) (envelope-from freebsd@walstatt-de.de) Received: from smtp052.goneo.de (smtp052.goneo.de [85.220.129.60]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4VtvrW6brFz427B for ; Tue, 4 Jun 2024 15:38:35 +0000 (UTC) (envelope-from freebsd@walstatt-de.de) Authentication-Results: mx1.freebsd.org; none Received: from hub2.goneo.de (hub2.goneo.de [IPv6:2001:1640:5::8:53]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by smtp5.goneo.de (Postfix) with ESMTPS id D3B15240C54; Tue, 4 Jun 2024 17:38:33 +0200 (CEST) Received: from hub2.goneo.de (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by hub2.goneo.de (Postfix) with ESMTPS id 38B4924055C; Tue, 4 Jun 2024 17:38:32 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=walstatt-de.de; s=DKIM001; t=1717515512; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=HxgOJfg3OB7JLIVTn4pP8ES1c833IgC0vYUsvkG6qzA=; b=RqmOEaSEG4lWkjKXSOBTJNErbC+9iMBhKDknL+qnnbQlAQ+To8mdNmpYkpCOnzaKVV9/ds lCv5Av3ycbGwhdkeYMU2OBPt6C5wV3cyXRuu9Ut2wDCY4JsTtZMFvaJPZVJ7mlvmdfG/ip 6usrNFgpuiBeB82ataSPogkfMl/ahgA0V9eVtH/PD6KhxWrouq7GlpwPfVReuHlaF8aGFE 0zfBL0I1sOnfbj4u3+MEuhDtijp7los0gX74qJiNQyQ5jRMtm0Pzlf+Qa9Pz7RWFh0O7J9 FOvXaZlpaqMEtmZ4k6cDjM4iMFhSTFGwTT4eeoWCE+EwhEoS3NA849KvxgjHWQ== Received: from thor.intern.walstatt.dynvpn.de (dynamic-078-055-093-184.78.55.pool.telefonica.de [78.55.93.184]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by hub2.goneo.de (Postfix) with ESMTPSA id F0FF92404CD; Tue, 4 Jun 2024 17:38:31 +0200 (CEST) Date: Tue, 4 Jun 2024 17:37:55 +0200 From: FreeBSD User To: Alexander Leidinger Cc: FreeBSD CURRENT Subject: Re: bridge: no traffic with vnet (epair) beyond bridge device Message-ID: <20240604173822.4c61c1b9@thor.intern.walstatt.dynvpn.de> In-Reply-To: <2433e25ebf6eae827bcd7912bbe27fbc@Leidinger.net> References: <20240603210231.64889de0@thor.intern.walstatt.dynvpn.de> <2433e25ebf6eae827bcd7912bbe27fbc@Leidinger.net> Organization: walstatt-de.de List-Id: Discussions about the use of FreeBSD-current List-Archive: https://lists.freebsd.org/archives/freebsd-current List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-current@FreeBSD.org MIME-Version: 1.0 Content-Type: multipart/signed; boundary="Sig_/VE/tBw9YatRgLz1elRFZIZB"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Rspamd-UID: 5ce1de X-Rspamd-UID: 68d83e X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:25394, ipnet:85.220.128.0/17, country:DE] X-Rspamd-Queue-Id: 4VtvrW6brFz427B --Sig_/VE/tBw9YatRgLz1elRFZIZB Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Am Tue, 04 Jun 2024 09:36:38 +0200 Alexander Leidinger schrieb: > Am 2024-06-03 21:02, schrieb FreeBSD User: > > Hello, > >=20 > > I'm running a dual socket NUMA CURRENT host (Fujitsu RX host) running=20 > > several jails. Jails are > > attached to a bridge device (bridge1), the physical device on that=20 > > bridge is igb1 (i350 based > > NIC). The bridge is created via host's rc scripts, adding and/or=20 > > deleting epair members of the > > bridge is performed by the jail.conf script. > >=20 > > I do not know how long the setup worked, but out of the blue, last week= =20 > > after a longish > > poudriere run after updating the host to most recent CURRENT (as of=20 > > today, latest update > > kernel and world) and performing "etcupdate" on both the host and all=20 > > jails, traffic beyond > > the bridge is not seen on the network! All jails can communicate with=20 > > each other. Traffic from > > the host itself is routed via igb0 to network and back via igb1 onto=20 > > the bridge. > >=20 > > I check all setups for net.link.bridge: > >=20 > > net.link.bridge.ipfw: 0 > > net.link.bridge.log_mac_flap: 1 > > net.link.bridge.allow_llz_overlap: 0 > > net.link.bridge.inherit_mac: 0 > > net.link.bridge.log_stp: 0 > > net.link.bridge.pfil_local_phys: 0 > > net.link.bridge.pfil_member: 0 > > net.link.bridge.ipfw_arp: 0 > > net.link.bridge.pfil_bridge: 0 > > net.link.bridge.pfil_onlyip: 0 > >=20 > > I did not change anything (knowingly). > >=20 > > I also have an oldish box running single socket processor, also driven= =20 > > by the very same > > CURRENT and similar, but not identical setup. The box is running very=20 > > well and the bridge is > > working as expected. > >=20 > > I was wondering if something in detail has changed in the handling of=20 > > jails, epair and > > bridges. I followed the setup "after the book", nothing suspicious. =20 >=20 > "after the book" =3D the IP of the host itself is not on igb1 but on a=20 > different interface or on the bridge? >=20 > Is there a firewall active on the box itself? Which one? >=20 > What does wireshark / a traffic dump at the physical interface level=20 > tell compared to a traffic dump at the switch interface? Did you replace= =20 > the cable / SFP / move to a different switch port as a test? >=20 > I suggest to provide the output of ifconfig -a and netstat -rn (feel=20 > free to mangle the IPs, as long as the mangling is a consistent=20 > replacement and not a cut-off). >=20 > Bye, > Alexander. >=20 Hello Alexander and everybody brave enough reading my post. Somehow I managed it to let=20 "ifconfig_igb1=3D"up" disappear - I guess by accident when sneaking through the rc.conf file. igb1 is the physical device connecting to the network. The bridge is layer = 2 only, no IP, only the vnet-portions pointing towards the jail do have IPv6 and IPv4. The brid= ge has around 20 members, the last entry is igb1 - I never checked whether it is up ... Sorry! Kind regards, oh --=20 O. Hartmann --Sig_/VE/tBw9YatRgLz1elRFZIZB Content-Type: application/pgp-signature Content-Description: OpenPGP digital signature -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQRQheDybVktG5eW/1Kxzvs8OqokrwUCZl807gAKCRCxzvs8Oqok r35SAQCBNJiUsss+3BvOWQVuOsh+QubxwWM3bYKs31WaSUWavAEA1I2EBw55S1J4 K8ThmAx1zZXHp6Dz8W4RA6KTcKD1Dwo= =fuxM -----END PGP SIGNATURE----- --Sig_/VE/tBw9YatRgLz1elRFZIZB--