From owner-freebsd-pf@FreeBSD.ORG Wed Feb 9 22:11:24 2005 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3A75516A4CE for ; Wed, 9 Feb 2005 22:11:24 +0000 (GMT) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.185]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8DF1F43D49 for ; Wed, 9 Feb 2005 22:11:23 +0000 (GMT) (envelope-from max@love2party.net) Received: from [212.227.126.179] (helo=mrelayng.kundenserver.de) by moutng.kundenserver.de with esmtp (Exim 3.35 #1) id 1Cz03N-0004ql-00; Wed, 09 Feb 2005 23:11:21 +0100 Received: from [217.227.147.152] (helo=donor.laier.local) by mrelayng.kundenserver.de with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1Cz03M-0007Di-00; Wed, 09 Feb 2005 23:11:21 +0100 From: Max Laier To: Andy Hilker Date: Wed, 9 Feb 2005 23:11:41 +0100 User-Agent: KMail/1.7.2 References: <20050209131055.GA94001@mail.crypta.net> <200502091945.01577.max@love2party.net> <20050209215832.GA22874@mail.crypta.net> In-Reply-To: <20050209215832.GA22874@mail.crypta.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart13349901.uKPbb2PvEP"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200502092311.47713.max@love2party.net> X-Provags-ID: kundenserver.de abuse@kundenserver.de auth:61c499deaeeba3ba5be80f48ecc83056 cc: freebsd-pf@freebsd.org Subject: Re: problems with synproxy on 5.3-stable X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical discussion and general questions about packet filter (pf) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Feb 2005 22:11:24 -0000 --nextPart13349901.uKPbb2PvEP Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Wednesday 09 February 2005 22:58, Andy Hilker wrote: > You (Max Laier) wrote: > > Not really, but tcpdump can help. Add log-all to the synproxy and try = to > > watch the connection in tcpdump on pflog0 with something like: > > $tcpdump -n -e -ttt -i pflog0 rulenum and host "testip" > > > > You might also want to raise the debugging level with "$pfctl -x misc" > > and watch the console for BAD state messages. > > Ok, i modified my ruleset like this: > > [...] > set loginterface $if_ext That does not matter here. It only affects $pfctl -si > [...] > pass in log quick on $if_ext proto tcp from any to ^^^ Change this to "log-all" in order to get the full transaction log on pflog.= =20 If you happen to know a "known bad"-peer you can also split the rule as: pass in log-all quick on $if_ext proto tcp from $bad_peer to \ port =3D 80 flags S/SA synproxy state pass in quick on $if_ext proto tcp from any to \ port =3D 80 flags S/SA synproxy state > port =3D 80 flags S/SA synproxy state > > Then typed "pfctl -x loud" and "tcpdump -n -e -ttt -i pflog0". > Output looks like without "pfctl -x loud". Where do i see debug output? $dmesg -a should turn it up. It's written to the console. > > Keep us posted, thanks. > > Yes, sure. > But before I call the person who has problems and let him try again, > I have to be sure, to debug the right way. Be sure to have pflogd(8) or tcpdump logging the traffic on pflog0 while th= e=20 connection attempt. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart13349901.uKPbb2PvEP Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQBCCoqjXyyEoT62BG0RAqoHAJ9qPzPnIcamEYzjy4LtT6t23KG+LwCePPg/ H1IyROT7m4G0ccu10J6fuHI= =wy5k -----END PGP SIGNATURE----- --nextPart13349901.uKPbb2PvEP--