Re: NAT before IPSEC - reply packets stuck at enc0

2017-07-21 Thread Muenz, Michael
Am 21.07.2017 um 13:08 schrieb Andrey V. Elsukov: With ipfw(4) it should work, at least on FreeBSD. pfsense/opensense have their own patches, so I don't know what can be wrong there. I also tried 11.0 and 11.1RC3 vanilla kernels, no luck. Will build a test setup with the OPNsense devs. I'm s

mbuf clusters leak in netinet6

2017-07-21 Thread Daniel Bilik
Hi. (Please keep me in cc, I'm not subscribed to the list.) After deploying ndproxy[1] on a few 10-stable hosts, some of them have experienced mbuf clusters exhaustion. Initial analysis showed that after loading ndproxy.ko, "current" values of "mbuf clusters" and "mbuf+clusters out of packet seco

Re:Reach Out Infor Users

2017-07-21 Thread JANAE.OLSON
Hi, I see that you are an Infor partner and thought if you would like to acquire Infor customers database to increase your customer base. Infor Users - 37,584 IT decision makers List Contains: Name, Company's Name, Phone Number, Fax Number, Job Title, Email address, Complete Mailing Address, SIC

Re: ipsec encryption only via given route

2017-07-21 Thread Eugene Grosbein
21.07.2017 23:05, Kajetan Staszkiewicz wrote: > Unfortunately I don't see much information how to make it work with > Strongswan. Any hints? If you run Strongswan/FreeBSD instead of plain FreeBSD, you should ask Strongswan maintainers for that :-) __

Re: ipsec encryption only via given route

2017-07-21 Thread Kajetan Staszkiewicz
Dnia piątek, 21 lipca 2017 17:09:35 CEST Eugene Grosbein pisze: > 20.07.2017 23:17, Kajetan Staszkiewicz пишет: > > Hey group, > > > > Can I somehow make IPsec encryption to happen AFTER routing decision and > > ensure that it happens only when traffic leaves via specified interface? > > You may

Re: May I ask where could I find the TCP BBR patches?

2017-07-21 Thread Julian Elischer
On 21/7/17 1:23 pm, Jov wrote: Maybe you are also interested in kcp/kcptun: https://github.com/xtaci/kcptun looks to me like kcp might be implemented pretty easily as a netgraph module, BBR looks like it would be relatively simple to port and I look forward to seeing it. There is also a F

[Bug 186114] net/mpd5 hangs after a certain number of users connect

2017-07-21 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=186114 Eugene Grosbein changed: What|Removed |Added Status|In Progress |Closed Resolution|---

[Bug 186114] net/mpd5 hangs after a certain number of users connect

2017-07-21 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=186114 Bug 186114 depends on bug 220151, which changed state. Bug 220151 Summary: [libc] syslog() thread unsafety: mutex lock leak https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220151 What|Removed |Added

[Bug 186114] net/mpd5 hangs after a certain number of users connect

2017-07-21 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=186114 --- Comment #123 from Cassiano Peixoto --- (In reply to Eugene Grosbein from comment #116) Hi Eugene, The server has been running for 14 days without freezing. I think the issue has been fixed :) How would you like to proceed? Are you goi

Re: NAT before IPSEC - reply packets stuck at enc0

2017-07-21 Thread Muenz, Michael
Am 21.07.2017 um 13:08 schrieb Andrey V. Elsukov: On 21.07.2017 13:59, Muenz, Michael wrote: Am 19.07.2017 um 15:35 schrieb Andrey V. Elsukov: Check what you will see if you set net.enc.in.ipsec_bpf_mask=3. You should see the reply two times, the second one should be with translated address.

Re: NAT before IPSEC - reply packets stuck at enc0

2017-07-21 Thread Andrey V. Elsukov
On 21.07.2017 13:59, Muenz, Michael wrote: > Am 19.07.2017 um 15:35 schrieb Andrey V. Elsukov: >> >> Check what you will see if you set net.enc.in.ipsec_bpf_mask=3. >> You should see the reply two times, the second one should be with >> translated address. >> > Googling around with "nat before ipse

Re: NAT before IPSEC - reply packets stuck at enc0

2017-07-21 Thread Muenz, Michael
Am 19.07.2017 um 15:35 schrieb Andrey V. Elsukov: Check what you will see if you set net.enc.in.ipsec_bpf_mask=3. You should see the reply two times, the second one should be with translated address. Googling around with "nat before ipsec" and freebsd shows many topics like this. It seems with

Re: ipsec encryption only via given route

2017-07-21 Thread Eugene Grosbein
20.07.2017 23:17, Kajetan Staszkiewicz пишет: > Hey group, > Can I somehow make IPsec encryption to happen AFTER routing decision and > ensure that it happens only when traffic leaves via specified interface? You may want to upgrade to 11.1-RELEASE and utilize its new if_ipsec(4) feature targete