On 08/09/12 20:00, YongHyeon PYUN wrote:
On Wed, Aug 08, 2012 at 02:33:25PM +0300, George Mamalakis wrote:
Hi all,
Suddenly I am facing a problem on a new PC, using a configuration that I
have been using on more than 10 servers for the last few years. The only
thing that I find that differs from my other configuratinos is the NIC
of the PC. If not, I must be missing something very trivial.
I have built a jail on this PC, following the handbook's guidelines
(section: application of jails). The PC has one NIC, msk0, where I run
pf on (built on my kernel; I have already tried using the module). My
pf.conf is as simple as possible:
# cat /etc/pf.conf
nat on msk0 from any to any -> 10.0.3.6
pass quick all
when I jexec inside the jail, and pf is running, I am unable to reach
any machine except my jail (not even the host). If pf is off, the
network works just fine (of course my router knows where to find my
jail's subnet).
What is strange is that if I tcpdump on msk0, then after a few seconds
that I request something from within the jail, I see the packets going
and coming on msk0 using the correct IP (the NAT IP), but it seems that
the machine fails to route them back inside the jail.
I guess this is the same issue reported in kern/170081.
Some msk(4) controllers lack full hardware checksum offloading
capability such that pseudo checksum should be computed by upper
layer. It seems pf(4) NAT was broken for controllers that lack
pseudo checksumming. This indicates the following ethernet
controller do not work with pf(4) NAT.
sk(4), msk(4), fxp(4), hme(4) and gem(4)
Try disabling RX checksum offloading as a work-around.
#ifconfig msk0 -rxcsum
You were absolutely right! Once I disabled RX checksum offloading -as
you suggested- everything started working just fine.
Since this issue has been reported already, I will not send a bug report.
Thanx again!
--
George Mamalakis
IT and Security Officer
Electrical and Computer Engineer (Aristotle Un. of Thessaloniki),
MSc (Imperial College of London)
Department of Electrical and Computer Engineering
Faculty of Engineering
Aristotle University of Thessaloniki
phone number : +30 (2310) 994379
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"
