On 4/3/2007 9:11 AM Max Laier wrote:
On Monday 02 April 2007 23:15, Drew Tomlinson wrote:
I run Bacula v1.38 on my home network.  Ever since I moved from ipfw2
to pf, backups fail intermittently on my router due to "broken network
pipes" usually after somewhere around 10 MB - 12 MB has been
transfered.  Thus small incremental backups are successful but larger
full backups are not.  I do not have this problem when I disable pf on
the router, nor do I have problems when completing backups with other
machines on my internal network.  My setup looks like this:

bacula director --------- router (client)
192.168.1.4 (fxp0)        192.168.1.2 (dc0)

Communication takes place on ports 9102 and 9103.  I captured this
output from pflog0 after starting a backup:

blacksheep# tcpdump -netttti pflog0 "( host blacksheep or blacklamb )
and ( port 9102 or port 9103 )"
tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode listening on pflog0, link-type PFLOG (OpenBSD pflog file),
capture size 96 bytes
2007-04-02 13:57:21.021122 rule 7/0(match): pass in on dc0:
192.168.1.4.52295 > 192.168.1.2.9102: S 2822997678:2822997678(0) win
65535 <mss 1460,nop,wscale 1,[|tcp]>
2007-04-02 13:57:23.532037 rule 13/0(match): pass out on dc0:
192.168.1.2.64955 > 192.168.1.4.9103: S 2265048451:2265048451(0) win
65535 <mss 1460,nop,wscale 1,[|tcp]>
2007-04-02 13:57:23.532323 rule 7/0(match): pass in on dc0:
192.168.1.4.9103 > 192.168.1.2.64955: S 3452777266:3452777266(0) ack
2265048452 win 65535 <mss 1460,nop,wscale 1,[|tcp]>

And the rules are:

@7 pass in log on dc0 inet proto tcp from 192.168.1.0/24 to any
modulate state queue(std_out, ack_out)

This rule should have "flags S/SA" on it.

In my attempts to get ALTQ queuing working, I have found that adding flags here breaks it. However I am sure I am not approaching queuing correctly. I posted a bit about the problem here:

http://www.freebsd.org/cgi/getmsg.cgi?fetch=4242+9504+/usr/local/www/db/text/2007/freebsd-pf/20070225.freebsd-pf

After getting no response (which made me think my approach was way off), I attempted to redo my rule set and asked for help here:

http://www.freebsd.org/cgi/getmsg.cgi?fetch=87780+93096+/usr/local/www/db/text/2007/freebsd-pf/20070401.freebsd-pf

This post received one response regarding "keep state" and flags as well. I think I understand the concept about stateful inspections but I do not understand how to get queuing to work only on packets sent from my router to machines over the Internet. Seems that when I make "keep state" rules on inbound connections, the return traffic matches the state rules and thus never gets queued. I would LOVE to understand this better and would really appreciate any links to suggested reading.

@13 pass out log on dc0 inet all

Any ideas why Bacula would have such a problem?  Other things to check?

Can you turn on pf debugging via "pfctl -xm" and watch the console while doing the backup? Also monitor "pfctl -si" for increasing counters - esp. state-mismatch.
OK, I tried this and it's obvious to me that my pf configuration is not correct. I see tons of messages such as these:

Apr 3 15:49:42 blacksheep kernel: pf_map_addr: selected address 66.205.146.210 Apr 3 15:49:46 blacksheep kernel: pf: BAD state: TCP 140.105.134.102:54934 140.105.134.102:54934 192.168.1.4:25 [lo=836336158 high=836336204 win=33304 modulator=0] [lo=1850627322 high=1850660626 win=46 modulator=0] 4:4 PA seq=836336158 ack=1850627322 len=185 ackskew=0 pkts=4:5 dir=in,fwd Apr 3 15:49:46 blacksheep kernel: pf: State failure on: 1 | However in searching the logs for messages containing the IP address of the router (192.168.1.2) while running a full backup that errored out after just 2.2 MB of data transfer, I found these entries:

Apr 3 15:50:19 blacksheep kernel: pf: BAD state: TCP 192.168.1.2:50083 192.168.1.2:50083 192.168.1.4:9103 [lo=1243881036 high=1243914340 win=33304 modulator=0] [lo=3549637128 high=3549637922 win=33304 modulator=0] 4:4 A seq=3549637128 ack=1243881036 len=1448 ackskew=0 pkts=1081:1727 dir=out,rev Apr 3 15:50:19 blacksheep kernel: pf: State failure on: 1 | Apr 3 15:50:19 blacksheep kernel: pf: BAD state: TCP 192.168.1.2:50083 192.168.1.2:50083 192.168.1.4:9103 [lo=1243881036 high=1243914340 win=33304 modulator=0] [lo=3549638576 high=3549639370 win=33304 modulator=0] 4:4 A seq=3549638576 ack=1243881036 len=1448 ackskew=0 pkts=1082:1728 dir=out,rev

I didn't monitor "pfctl -si" as you suggested. Obviously the counters would be increasing dramatically. So apparently state failure is my problem, likely caused by my misunderstanding of how to create a proper pf ruleset to achieve my goals. I've been through OpenBSD's pf FAQ numerous times. I've read Peter Hansteen's tutorial many times. However I still can't seem to get it through my thick head how to write a proper ruleset to get queuing to work the way I want.

Thanks for any suggestions,

Drew

--
Be a Great Magician!
Visit The Alchemist's Warehouse

http://www.alchemistswarehouse.com

_______________________________________________
freebsd-pf@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to