Re: Hello! re0 watchdog and high-ish traffic?

2022-08-13 Thread Andrea Venturoli
On 8/13/22 17:44, gm...@dnmx.org wrote: Hello there! Hello. Basically when I get the download speed in something like qBittorrent to 4Mbit/s, then my internet connection resets, and in `dmesg` I get "re0: watchdog timeout" then re0 goes DOWN and UP.. and sometimes it seems to also get stuck

Re: Any reason to not implement VRRP in FreeBSD?

2023-01-26 Thread Andrea Venturoli
On 1/26/23 17:08, Nicolas MASSE wrote: Is there currently any reason to not have an implementation of VRRP inside FreeBSD? https://www.freshports.org/net/freevrrpd (I remember I used it in the past, many many years ago; when CARP was introduced in base, I switched, so I don't know how good i

bge performance inquiry

2023-02-16 Thread Andrea Venturoli
Hello. I'm evaluating a new box that will act as router... I've been offered BCM5720 network cards (which should run with the bge driver). Are they good WRT to stability and performance? I've always used Intel... Any good reason to stick with, e.g., an I210? bye & Thanks av.

Named warning

2023-04-12 Thread Andrea Venturoli
Hello. Lately, running bind 9.16.39, I'm seeing a lot of these (on several boxes): named[22122]: validating in-addr.arpa/SOA: got insecure response; parent indicates it should be secure I know the general answer (either a config problem upstream or a problem in my BIND validation), but in

OpenVPN suddenly working one way only

2024-07-05 Thread Andrea Venturoli
Hello. Not sure this is a question for FreeBSD or for OpenVPN directly... I'll try here first. I'm using OpenVPN quite heavily, as I have around 10 server-server tunnels, and several server-clients installations. They are all working properly except one, which will periodically start misbeha

Re: OpenVPN suddenly working one way only

2024-07-05 Thread Andrea Venturoli
On 7/5/24 11:31, Ronald Klop wrote: Of course this can be a firewall or routing issue somewhere in between the hosts blocking traffic from B to A. Hmm... The two hosts can communicate with any other protocol. Also the VPN can handshake, so packets are exchanged correctly. I'm only using ipfw:

Re: OpenVPN suddenly working one way only

2024-07-05 Thread Andrea Venturoli
On 7/5/24 16:32, Rodney W. Grimes wrote: However, I just changed UDP port and it seems to work! The "solution" didn't last: after a little more than 3 hours, this tunnel stopped working again :( Strangely restarting openvpn on both sides fixed this, this time. Or host A has a zombie pr

Re: OpenVPN suddenly working one way only

2024-07-06 Thread Andrea Venturoli
On 7/6/24 02:17, Rodney W. Grimes wrote: Host A *still* has/had a port open, and that port can lingere for several reasons, and that can cause issues. Ok, good, check both A and B. I had checked this too: neither A nor B had the port still open. MTU's? Have you manually checked path MTU t

Re: OpenVPN suddenly working one way only

2024-07-06 Thread Andrea Venturoli
On 7/6/24 17:02, Rodney W. Grimes wrote: Are you pinging the inside or outside address of the vpn? If you cant even ping the outside IP of a VPN you have basic connectivity problems that must be fixed before even attempting a VPN. I'll recap: I've got two hosts: A and B, which are in differnt

Re: OpenVPN suddenly working one way only

2024-07-07 Thread Andrea Venturoli
On 7/6/24 18:13, Patrick M. Hausen wrote: Hello. It's almost surely due to a problem with the UDP packets that implement the VPN: again, according to tcpdump they go out host B, but never reach host A. Is it remotely possible that one of the ISPs blocks these UDP packets as part of an autom

Re: OpenVPN suddenly working one way only

2024-07-07 Thread Andrea Venturoli
On 7/6/24 18:24, Michael Tuexen wrote: Or are any kind of NAT or Firewall involved which might loose state? Are you using public addresses on host A and B? Host B has a public IP address assigned to its "public" interface. Host A is behind NAT (it has a private IP assigned to its public inter

if_bridge hangs server

2013-04-24 Thread Andrea Venturoli
Hello. I hope someone can help me with the following problem... The box runs a 8.3p7/i386 and has three physical ethernet interfaces: em0, em1 and fxp1. em0 and em1 are bonded into lagg0, over which carp0 and carp1 run. fxp0 has three vlans: vlan1, vlan2 and vlan3, over which there are respect

Network troubles after 8.3 -> 8.4 upgrade

2014-04-17 Thread Andrea Venturoli
Hello. Three days ago I upgraded an amd64 8.3 box to the latest 8.4. Since then the outside network is misbehaving: large mails are not sended (although small ones do), svn operations will work for a while, then come to a sudden stop, etc... Perhaps the most evident test is "wget"ting a big fil

Re: Network troubles after 8.3 -> 8.4 upgrade

2014-04-19 Thread Andrea Venturoli
On 04/17/14 23:45, John Nielsen wrote: Thanks for answering John. My first thought was TSO as well, since I've seen the symptoms you describe a few times on systems running 10.0. > Do you use IPFW or any kind of NAT on this system? Yes, I use ipfw to firewall, to divert packets to natd and

Re: Network troubles after 8.3 -> 8.4 upgrade

2014-04-24 Thread Andrea Venturoli
On 04/19/14 19:19, Andrea Venturoli wrote: Hmmm, sounds a bit complicated... would simply dropping if_em.ko in from a 8.3 box work? Ok, I'll answer myself. I'm now running 8.3's if_em.ko (binary from another system), on an 8.4 kernel. The behaviour is the same as before. H

Server with multiple public IP

2014-04-28 Thread Andrea Venturoli
Hello. This has probably come up several times, however... I've got a server which has two (or more) interfaces with public IPs. Let's say, as an example (with fictional IPs): ifconfig_vlan1="inet 1.0.0.2 netmask 255.255.255.248..." ifconfig_vlan2="inet 2.0.0.2 netmask 255.255.255.248..." Of c

Re: Server with multiple public IP

2014-04-28 Thread Andrea Venturoli
On 04/28/14 11:18, Andreas Nilsson wrote: You could put all the services which are on 2.0.0.2 in a separate fib and there have another default-route. Thanks, but unfortunately I can't, since some services must be able to answer on both addresses. Maybe I could use socket in one fib to proxy

Re: Server with multiple public IP

2014-04-28 Thread Andrea Venturoli
On 04/28/14 11:16, Dominic Froud wrote: You want source-based routing. Thanks, that term will help me in my searches. I have this situation and I used pf(4) to do it with a rule like: pass out quick route-to ( vlan2 ) from 2.0.0.0/29 to any no state As a variation you can give an optiona

Re: Server with multiple public IP

2014-05-14 Thread Andrea Venturoli
On 04/28/14 11:16, Dominic Froud wrote: On 28/04/2014 09:58, Andrea Venturoli wrote: I've got a server which has two (or more) interfaces with public IPs. Let's say, as an example (with fictional IPs): ifconfig_vlan1="inet 1.0.0.2 netmask 255.255.255.248..." ifconfig

MTU not regrowing?

2014-06-24 Thread Andrea Venturoli
Hello. Today I experienced something weird (at least for me) on a 8.4 system: _ the system had vlan3 interface, with default MTU (1500 bytes); _ "ping -D -s 1400 somehost" would work, but "ping -D -s 1500 somehost" would yield "frag needed and DF set" (forgive me if the message is not exact, I

Re: MTU not regrowing?

2014-06-24 Thread Andrea Venturoli
On 06/24/14 21:03, John Hay wrote: Do a "route get somehost" and see what mtu is returned. You might be able to delete or tweak that route. Thanks a lot! I learned something new :) I'll try this next time I have the chance. bye av. ___ free

Re: MTU not regrowing?

2014-06-25 Thread Andrea Venturoli
On 06/25/14 02:01, Charles Swiger wrote: Does "ifconfig vlan3 down; ifconfig vlan3 up" do any good? Or that run against the physical NIC? Can't try this now, I'll do when I can play again with this box. What is the ethernet HW em0@pci0:6:0:0: class=0x02 card=0x10828086 chip=0x107d808

Re: MTU not regrowing?

2014-07-01 Thread Andrea Venturoli
On 06/25/14 15:23, Andrea Venturoli wrote: On 06/25/14 02:01, Charles Swiger wrote: Does "ifconfig vlan3 down; ifconfig vlan3 up" do any good? Or that run against the physical NIC? None of the two. John was right about the route. bye & Tha

Re: MTU not regrowing?

2014-07-01 Thread Andrea Venturoli
On 06/24/14 21:03, John Hay wrote: Do a "route get somehost" and see what mtu is returned. You are right, I see a route with the old, lesser MTU. You might be able to delete or tweak that route. How do I do this? I tried "route delete", but it doesn't help. bye & Thanks av. _

Re: MTU not regrowing?

2014-07-07 Thread Andrea Venturoli
On 07/02/14 04:53, John-Mark Gurney wrote: How do I do this? I tried "route delete", but it doesn't help. route change -mtu XXX This does not work: the route is deemed as non-existent. bye & thanks av. P.S. I'm writing this more out of curiosity, than of real need; no need to so

if_xl on 8.2

2011-11-23 Thread Andrea Venturoli
Hello. Just to say today I upgraded from 8.1 to 8.2 and xl0 stopped working. It is detected: xl0: <3Com 3c900B-COMBO Etherlink XL> port 0xd800-0xd87f mem 0xfdefe000-0xfdefe07f irq 17 at device 7.0 on pci1 xl0: selecting 10baseT transceiver, half duplex xl0: Ethernet address: 00:50:04:22:a9:c0 x

Re: if_xl on 8.2

2011-11-23 Thread Andrea Venturoli
On 11/23/11 19:05, Brian Seklecki (Mobile) wrote: Send us: grep ifconfig /etc/rc.conf ifconfig -a ifconfig -m netstat -i netstat -rn netstat -i arp -an ___ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-ne

Re: if_xl on 8.2

2011-11-23 Thread Andrea Venturoli
On 11/23/11 19:05, Brian Seklecki (Mobile) wrote: Send us: grep ifconfig /etc/rc.conf ifconfig -a ifconfig -m netstat -i netstat -rn netstat -i arp -an For both the working and non-working cards to compare. Sorry for the noise... I accidentally removed the "media" option from rc.conf and the

Intel 82550 Pro/100 Ethernet and TSO troubles

2011-12-14 Thread Andrea Venturoli
Hello. I recently installed 8.2 with the following card: > dmesg > ... fxp0: port 0xdc00-0xdc3f mem 0xfebfb000-0xfebfbfff,0xfebc-0xfebd irq 20 at device 5.0 on pci4 > ... > pciconv -lv > ... fxp0@pci0:4:5:0:class=0x02 card=0x00408086 chip=0x12298086 rev=0x0c hdr=0x00

Re: Intel 82550 Pro/100 Ethernet and TSO troubles

2011-12-14 Thread Andrea Venturoli
On 12/14/11 20:59, YongHyeon PYUN wrote: AFAIK the firmware of controller has no known TSO issue so it indicates a bug in driver. What makes me wonder is ICMP ECHO packet should not be affected by TSO and I have no clue at this moment. I wasn't talking about ICMP ECHO. What happened was: a) t

Re: Intel 82550 Pro/100 Ethernet and TSO troubles

2011-12-15 Thread Andrea Venturoli
On 12/14/11 22:32, YongHyeon PYUN wrote: Wireshark showed some wrong checksums (I believe on the ICMP packet, but I might remember wrong). You can check whether you received bad checksummed frames with netstat(1). I tried "netstat -ind", but it shows no Ierrs/Idrop/Oerrs/Odrop. Is simp

Re: Intel 82550 Pro/100 Ethernet and TSO troubles

2011-12-17 Thread Andrea Venturoli
On 12/15/11 23:13, YongHyeon PYUN wrote: I tried "netstat -ind", but it shows no Ierrs/Idrop/Oerrs/Odrop. Use -s option which will show statistics for each network protocols. Search 'discarded for bad checksums' from the output. Still all bad counters at zero. You'll see tso.dump and n

Re: Intel 82550 Pro/100 Ethernet and TSO troubles

2011-12-18 Thread Andrea Venturoli
On 12/16/11, Eugene Grosbein wrote: (Sorry Eugene, I didn't get your message until I searched the web). > Do you use NAT? man ipfw clearly states: > > ipfw nat is not compatible with > the TCP segmentation offloading (TSO). Thus, to reliably nat your net- > work traffic, please di

LAGG and CARP troubles

2012-03-16 Thread Andrea Venturoli
Hello. I'm using 7.4p6/i386 and this is (a part of) my configuration cloned_interfaces="lagg0 vlan1 vlan2 vlan3 carp0 carp1 carp6 carp7 carp9 carp10" ifconfig_em0="up" ifconfig_em1="up" ifconfig_lagg0="laggproto lacp laggport em0 laggport em1 192.168.101.1 netmask 255.255.255.0" ifconfig_carp0

CARP and LACP

2009-10-03 Thread Andrea Venturoli
Hello. Fast question: are the two above compatible? Can I use CARP over a lagg interface? bye & Thanks av. ___ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebs

FreeBSD + Samba + Active Directory

2009-10-09 Thread Andrea Venturoli
Hello. I have a setup with two FreeBSD 6.3 domain controllers using samba + openldap + nss_ldap. The company might be switching to Active Directory soon (not my choice, before you ask :-), so I might need to reconfigure the two FreeBSD boxes to become AD members (with winbindd, nss, whatever).

Wi-Fi bridge interferes with CARP

2009-10-23 Thread Andrea Venturoli
Hello. I'm curios about something which happened during a test in one of my networks. Two FreeBSD 6.3 boxes (one i386, one amd64) share some IP through CARP. Now, as soon as I plugged a wi-fi bridging access point on the net (which took it's IP from DHCP only for management), I started to see

snort on multiple interfaces

2009-10-28 Thread Andrea Venturoli
Some years ago, I checked to see whether I would be able to let a single snort process listen on more than one NIC. At the time it was only possible in Linux. Now, I searched a bit, but nothing new came up. Did anything improve since then? Do we still need multiple snort processes to listen on

ipfw uid and mpsafenet

2009-11-01 Thread Andrea Venturoli
Hello. I've got a 6.3 box in which I needed to use debug.mpsafenet=0 in order to avoid deadlocks with ipfw uid rules. I'm thinking of upgrading this to 7.2 and I see the above variable has gone away. Does this mean it is now safe to use such ipfw rules? The last things I could find wrt this ma

Connecting to a WatchGuard box

2009-11-30 Thread Andrea Venturoli
Hello. A customer of mine was connecting to a remote WatchGuard box through their Mobile VPN client. Now I'd like the server to take over that and le the whole network connect. Did anyone ever succeded in this? Is it possible? Should be IPSEC, but anyone has an how-to? bye & Thanks av

CARP + LAGG problem

2010-03-08 Thread Andrea Venturoli
Hello. I've a couple of 7.2p7 servers (one i386, the other amd64) which are working in parallel using CARP. Recently I bonded two interfaces on the former and CARP stopped working. Here's the relevant part from rc.conf on the first box: ifconfig_em0="up" ifconfig_em1="up" ifconfig_lagg0="laggp

Warnings with TSO on em

2010-05-10 Thread Andrea Venturoli
Hello. For quite a while, I've been seeing in the logs a lot of messages like the following: snort: (snort_decoder) WARNING: IP dgm len < IP Hdr len! I'm not sure about this, but I suspect they started when I upgraded from 6.3 to 7.2. Today, while investigating another problem, I decided I ha

Atheros ale problems

2010-06-22 Thread Andrea Venturoli
Hello. I'm having problems with 8.0/amd64 with the following card: a...@pci0:1:0:0:class=0x02 card=0x83041043 chip=0x10261969 rev=0xb0 hdr=0x00 vendor = 'Attansic (Now owned by Atheros)' device = 'PCI-E ETHERNET CONTROLLER (AR8121/AR8113 )' class = network

Re: Atheros ale problems

2010-07-31 Thread Andrea Venturoli
Il 07/02/10 00:41, Pyun YongHyeon ha scritto: Hello. I'm having problems with 8.0/amd64 with the following card: a...@pci0:1:0:0:class=0x02 card=0x83041043 chip=0x10261969 rev=0xb0 hdr=0x00 vendor = 'Attansic (Now owned by Atheros)' device = 'PCI-E ETHERNET CONTROL

CARP over LAGG

2010-08-03 Thread Andrea Venturoli
Hello. On a couple of 7.2 systems, I've got some carp interfaces build upon a physical interface (em0 or igb0) and everything works fine. On both box I've tried aggregating two interfaces (resp. em0+em1 and igb0+igb1) into a lagg0 interface, using LACP. However, in this case CARP will stop wo

pf stuck

2014-09-29 Thread Andrea Venturoli
Hello. Today a box of mine (8.4p16/amd64) stopped working as a router; I don't have a clear picture, but the internal nets were working perfectly, while the external interfaces lagged, dropped connections or stopped packets from passing. The box is running pf (for handling multiple Internet

Re: pf stuck

2014-09-29 Thread Andrea Venturoli
On 09/29/14 20:21, Ermal Luçi wrote: Probably is better you ask this on freebsd-pf@. Thanks, I see you have already cc:ed it. Though this sounds like state limit reached. Can this happen even if all my pf rules have "no state"? bye & Thanks av.

Dynamic ipfw rules' top

2014-12-31 Thread Andrea Venturoli
Hello. This might be a strange idea, but does such a thing exist? I mean: is there any tool that can show in real-time which dynamic rules are active, their timers, etc... like top does for processes? bye & Thanks av. ___ freebsd-net@freebs

ipfw dyn_keepalive

2015-05-08 Thread Andrea Venturoli
Hello. I'm having some troubles with dynamic rules and keep-alives... Let's say a client connect to a TCP port on my server and a keep-state rules allows the connection; the connection is setup correctly and some data exchanged. Then there is some minutes of silence and the rule expires. H

Again two ADSL lines, routing problems

2007-07-12 Thread Andrea Venturoli
Hello. I have a setup where a FreeBSD box is connected to two ADSL routers: default gateway is set to the first and, in case of failure, is moved to the other one. This works perfectly for outgoing connections: in the event of the switch, I'll have to reconnect, but that's acceptable. The pro

Re: Again two ADSL lines, routing problems

2007-07-12 Thread Andrea Venturoli
Artyom Viklenko ha scritto: You have to enforce simmetrical routing on your FreeBSD box. You can use, for example, PF firewall Using such options and features as labels and route-to/reply-to statemens. Also it is possible with ipfw, but I prefer PF. :) Thanks, this is interesting. However I

Re: Again two ADSL lines, routing problems

2007-07-12 Thread Andrea Venturoli
Eric F Crist ha scritto: > The biggest problem one would have with this sort of setup, is the upstream provider support. I don't know of any ISP's that are going to be willing or even able to propagate routes for your static IPs through their DSL systems. If you want that sort of redundancy

Re: Again two ADSL lines, routing problems

2007-07-12 Thread Andrea Venturoli
Josh Paetzel ha scritto: errrm, in pf I can give you a concrete example of how to deal with this. Thank you very much. Please see also my reply to Artyom. Your question seemed to imply that you don't want to load-balance or really even do round-robin NAT and you're fine with manually cutti

Re: Again two ADSL lines, routing problems

2007-07-12 Thread Andrea Venturoli
Artyom Viklenko ha scritto: Very brief example (just to show main idea). Assume you have thre interfaces in router fxp0 - lan, fxp1 - adsl1, fxp2 - adsl2. fxp0 - 192.168.0.1, fxp1 - 192.168.1.2, fxp2 - 192.168.2.2 adsl1 - 192.168.1.1, adsl2 - 192.168.2.1 $server="192.168.0.2" $adsl1="192.16

Latest Samba patches

2007-11-24 Thread Andrea Venturoli
After portupgrading two samba servers, I cannot connect any more to them through mount_smbfs. Connecting from Windows works fine. Am I the only one who is experiencing this problem? bye & Thanks av. ___ freebsd-net@freebsd.org mailing list ht

Re: Latest Samba patches

2007-11-25 Thread Andrea Venturoli
Per olof Ljungmark ha scritto: Andrea Venturoli wrote: After portupgrading two samba servers, I cannot connect any more to them through mount_smbfs. Connecting from Windows works fine. Am I the only one who is experiencing this problem? No, we are at least two :-) Ok, thanks. Any hint on

Routing problem with aliases

2008-05-07 Thread Andrea Venturoli
Hello. A box of mine has an interface configured with two IPs on two different nets: # ifconfig xl0: flags=8943 mtu 1500 options=9 inet 192.168.2.2 netmask 0xff00 broadcast 192.168.2.255 inet 192.168.0.2 netmask 0xff00 broadcast 192.168.0.255 ether 00:50:

Testing lagg

2008-05-28 Thread Andrea Venturoli
Hello. I've got a new box which features two gigabit ports and I though I'd try lagg with LACP. On the box I put the following in /etc/rc.conf: ifconfig_em0="up" ifconfig_em1="up" ifconfig_lagg0="laggproto lacp laggport em0 laggport em1 192.168.100.101 netmask 255.255.255.0" Then I aggreg

Re: Testing lagg

2008-05-29 Thread Andrea Venturoli
Gary Palmer ha scritto: Does the switch have spanning tree enabled? Yes. Should it be? bye & Thanks av. ___ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL

bridge + ip_alias --> SLOW!!!

2004-08-30 Thread Andrea Venturoli
Hello, I've got a problem I cannot understand and hope someone can help me. I've got a machine which must firewall a whole class C subnet. The upstream router (100Mb/s fiber connection) is configured as xxx.xxx.xxx.254, so I've chosen xxx.xxx.xxx.1 for my box and bridge with the other xxx.xxx.xxx

Re: bridge + ip_alias --> SLOW!!!

2004-09-01 Thread Andrea Venturoli
** Reply to note from "Chris Dionissopoulos[freemail]" <[EMAIL PROTECTED]> Tue, 31 Aug 2004 07:01:11 +0300 > Andrea, > Try something like this as alternative configuration: Thank you very much for the answer. Unfortunately I didn't want to mess remotely with this kind of configuration, so I

panic with 4.10p4 and ipfw2

2004-12-09 Thread Andrea Venturoli
Hello. A box of mine, which acts as firewall/bridge, is experiencing frequent panics. As said in the subject line, it's a 4.10-RELEASE-p4 with ipfw2 enabled in the kernel. I've run through post mortem kernel analisys and found out that the crashes are always related to ipfw2; specifically I get: pa

ipfw verbosity

2005-03-12 Thread Andrea Venturoli
Hello. I noticed that when I issue "sh /etc/rc.firewall" to reload firewall rules from a remote console, I get disconnected (as I would expect) and locked out! The problems seems to be that "ipfw -f" prints: "command is /usr/local/...". This is in /usr/src/sbin/ipfw/ipfw2.c: fprintf(stderr, "com

Problems with latest freevrrpd.

2005-06-16 Thread Andrea Venturoli
Hello. I have two FreeBSD 4.11 boxes which have been using freevrrpd for a long time. Today I upgraded from 0.8.7 to 0.9.3 and since then I started having some problems. Specifically I started to see this messages on both boxes: freevrrpd[822]: ip ttl of vrrp packet isn't set to 255. Packet

Re: WiFi and NFS

2017-08-13 Thread Andrea Venturoli
On 08/13/17 15:43, Grzegorz Junka wrote: Thanks a lot! That looks exactly like what I need. However, when I was checking the lagg configuration a few years ago, at that time it wasn't possible to set up a lagg with WiFi. Has anything changed (fairly) recently? Don't know about history, but I

Help provisioning a Samba AD in a jail on ZFS

2017-11-01 Thread Andrea Venturoli
Hello. As per subject, I'm building a new box which must host a jail running a Samba AD, but I have trouble provisioning it. Currently I'm trying samba44. I read a lot of material and I think I understand the problem: it seems the "samba-tool provision" script is incompatible with NFSv4ACL us

Re: Help provisioning a Samba AD in a jail on ZFS

2017-11-05 Thread Andrea Venturoli
On 11/02/17 08:09, Alexander Zagrebin wrote: В Wed, 1 Nov 2017 16:01:18 +0100 Andrea Venturoli пишет: It seems it's offtopic here, but I'll try to answer. Doh! I was going to write to -port, but wrote -net in the end... Sorry! To setup a new samba46-based domain controller

bridge0 not working when cable disconnected

2017-11-16 Thread Andrea Venturoli
Hello. I've got the following setup: re0: 192.168.x.1 (main IP) 192.168.x.2 (jail) 192.168.x.3 (jail) 192.168.x.4 (jail) tap0: VM-bhyve VM (using 192.168.x.9) bridge0: connecting re0 and tap0. The VM used to work properly. Now, however, I've got the network cable temporarily d

[SOLVED] Re: bridge0 not working when cable disconnected

2017-11-23 Thread Andrea Venturoli
On 11/16/17 19:01, Eugene Grosbein wrote: If you add an interface to a bridge, you should remove all IP addresses from it and assign them to the bridge itself instead. And you will be fine. Thanks. In fact, assigning the base IP and all the jails to bridge0, instead of re0 solved. I still th

Re: [SOLVED] Re: bridge0 not working when cable disconnected

2017-11-24 Thread Andrea Venturoli
On 11/24/17 10:52, Vincenzo Maffione wrote: Hi,   The VM IP is assigned to the emulated interface inside the guest OS (e.g. vtnet0). It would not make sense to assign an IP to tap0, and I'm quite sure bhyve doesn't do that. Right. Sorry for having expressed this with wrong wording. bye & T

Questions about ipfw's dynamic rules' dyn_keepalive

2018-04-03 Thread Andrea Venturoli
Hello. I'm trying to find out how dyn_keepalive works. From ipfw(8): net.inet.ip.fw.dyn_keepalive: 1 Enables generation of keepalive packets for keep-state rules on TCP sessions. A keepalive is generated to both sides of the con- nection every 5 seco

Re: Questions about ipfw's dynamic rules' dyn_keepalive

2018-04-07 Thread Andrea Venturoli
On 04/03/18 12:54, Andrey V. Elsukov wrote: On 03.04.2018 13:45, Andrey V. Elsukov wrote: Can anybody give any hint about the above behaviours or point me to good documentation? The man pages is very brief on this, unfortunately. Hi, Thanks for your answer. ipfw uses M_SKIP_FIREWALL flag

Proxy a TCP connection

2018-05-18 Thread Andrea Venturoli
Hello. Let's say I have a router connected to the Internet on one side and to a LAN with private IPs on the other. I want some clients from outside to be able to connect to a TCP service on a machine on the LAN: they should connect to port X on the firewall's public IP and reach port Y on the

Re: Proxy a TCP connection

2018-05-19 Thread Andrea Venturoli
On 05/19/18 03:10, Eugene Grosbein wrote: You don't need any additional software at all. Just instruct FreeBSD kernel to do what you need, it will do that just fine. Thanks. In fact I've used ipfw nat in the past, but I'd rather use a userland daemon: doing things at rule level makes it more

Re: Proxy a TCP connection

2018-05-19 Thread Andrea Venturoli
On 05/19/18 00:08, Reshad Patuck wrote: Hi, If you are running pf or ipfw on your router you could use a forward rule to forward connections that come in on a certain internet IP and port to a select internal IP or port. Thanks. I'm in fact using ipfw, but already have quite a complex rule s

Re: Proxy a TCP connection

2018-05-21 Thread Andrea Venturoli
On 05/21/18 13:16, Luciano Mannucci wrote: On Fri, 18 May 2018 23:29:33 +0200 Andrea Venturoli wrote: Does anyone have a good suggestion for a program similar to the above ones? I require nothing fancy, I just want it to be reliable. The oldest, the simplest, the most reliable (I'm

Re: Proxy a TCP connection

2018-06-14 Thread Andrea Venturoli
On 05/21/18 18:10, Andrea Venturoli wrote: Thanks to anyone who answered. I'm currently trying net/bounce, as suggested by Eugene. If that won't work properly, I'll sure give plugdaemon a shot. Just an update in case anyone is interested... Bounce is still dying occasionally;

Re: Questions about ipfw's dynamic rules' dyn_keepalive

2018-07-04 Thread Andrea Venturoli
tting must be done on boot and cannot be enabled later or something like that? For wishmaster: Since you said it works for you, can I ask which FreeBSD version you tested this on? Do you have any other patch or specific setup? How did you test this? Thanks a lot to anyone Andrea Vent

Re: FCP-0101: Deprecating most 10/100 Ethernet drivers

2018-10-07 Thread Andrea Venturoli
On 10/4/18 3:07 PM, Warner Losh wrote: At the root of this problem is the community's long resistance to having data reported back to the project data about the machines running FreeBSD. Absent any real and significant data, the only way to know if things are unused is to ask. We cannot have the

CARP troubles with 10.x

2016-12-22 Thread Andrea Venturoli
Hello. I've been using CARP for years and I'm only getting troubles since a week or so. My setup is as follows: |re0=10.1.2.13/10.1.2.127 fw1 fxp0=192.168.124.3| |client re0=10.1.2.18| --- --- |192.168.124.1 router

Some questions about in-kernel NAT

2017-03-08 Thread Andrea Venturoli
Hello. I'm using "ipfw nat" on several 10.3 boxes, but I have some questions. Let's start with a simple one: how do I list configured NATs and their details? I know I can configure a NAT with "ipfw nat 1 config ...", but how do I show what I did? Second question: _ if I issue "ipfw nat 2

Re: Some questions about in-kernel NAT

2017-03-08 Thread Andrea Venturoli
On 03/08/17 18:03, Freddie Cash wrote: It's listed in the EXAMPLES section of the ipfw(8) man page. ipfw nat show config​ <-- view config for all nat instances ipfw nat 123 show config <-- view config for nat 123 ipfw nat 111-999 show<-- view logs for nat 111-999 Oops!!! Been working

Re: OpenVPN and policy routing

2017-03-30 Thread Andrea Venturoli
On 03/30/17 05:22, Victor Sudakov wrote: Dear Colleagues, Anyone experienced with OpenVPN on FreeBSD? What would be the best way to policy route a network into OpenVPN? A routing decision must be based on the src IP address, not the dst IP address. Imagine an OpenVPN client with 3 interfaces:

Re: OpenVPN and policy routing

2017-03-30 Thread Andrea Venturoli
On 03/30/17 09:46, Victor Sudakov wrote: Will "ipfw fwd" do the trick? I could "ipfw fwd" the packets into the tun0 interface, but will OpenVPN understand that? Never tried this, sorry. bye av. ___ freebsd-net@freebsd.org mailing list https

Re: WiFi and NFS

2017-08-13 Thread Andrea Venturoli
On 08/13/17 13:47, Grzegorz Junka wrote: On my laptop I have two interfaces, wlan0 (WiFi) and ue0 (LAN). Obviously LAN is faster but not always connected. Is there any way to tell the system to use LAN interface in preference to the other? You mean: https://www.freebsd.org/doc/en_US.ISO8859-

Re: Two or more exports files, is it feasible?

2019-10-29 Thread Andrea Venturoli
On 2019-10-29 03:57, Thomas Mueller wrote: Is is possible to have two or more /etc/exports files, using different names of course? While I cannot answer your question... One possible scenario is having one exports file for NFS 4 and one for NFS3, for clients that don't support NFS 4? ..

net.inet.tcp.pmtud_blackhole_detection

2019-11-13 Thread Andrea Venturoli
Hello. Running 11.3, is there any risk or downside in enabling this? I cannot reach my homebanking otherwise; I think either the bank has completely disabled ICMP or some router in between filters it. I see it's not enabled by default: is it just out of precaution? bye & Thanks av.

Help with VNET

2020-10-21 Thread Andrea Venturoli
Hello. I've been using jails for years with ezjail. Now I'm trying to experiment with VNET. I've looked for a tutorial, but found scarce (and possibly outdated) info. Box is a 12.1/amd64. Basic configuration involves wlan0 configured via DHCP (192.168.133.26). Host networking works. For a st

Re: Help with VNET

2020-10-21 Thread Andrea Venturoli
On 10/21/20 12:19 PM, Goran Mekić wrote: Did you setup NAT? No. Should I? Why? The IP I gave to the jail is in the same subnet as the host. BTW, I have similar (working) setups with bhyve (using tap instead of epair) and I didn't setup NAT there. bye & Thanks av. __

Re: Help with VNET

2020-10-21 Thread Andrea Venturoli
On 10/21/20 12:20 PM, Kristof Provost wrote: This is your problem. You can’t bridge over wifi interfaces. > That’s a limitation of station mode wifi. I had the suspect... Is this documented somewhere? Is this a bug or feature? Try routing, or try with a wired interface. I'll try and get

net/realtek-re-kmod panics with debug kernel

2021-06-07 Thread Andrea Venturoli
Hello. I've got a 12.2/amd64 desktop pc with the following on the motherboard: re0: port 0xe000-0xe0ff mem 0xf7404000-0xf7404fff,0xf740-0xf7403fff irq 33 at device 0.0 on pci4 Unfortunately it's not easy to plug a new PCI NIC into it, and since re0 tends to hang on load, I'm using the

Re: net/realtek-re-kmod panics with debug kernel

2021-06-08 Thread Andrea Venturoli
On 6/8/21 9:16 AM, Alex Dupre wrote: Just to be sure, have you recompiled the kernel module with the same sources as the new debug kernel? Sure! If so, probably the best location to open a bug report might be here: https://github.com/kostikbel/rere/issues Done! bye & Thanks av.

Some strangeness with CARP

2022-02-12 Thread Andrea Venturoli
Hello. I've set up a network with CARP and I think I'm seeing something strange. What follows is a simplified setup (the real one involves lagg and vlan, but this should not matter). I have a Zyxel managed switch, two "servers": - A 192.168.0.1 - B 192.168.0.2 and two "clients" - C 192.168.0.

Re: Some strangeness with CARP

2022-02-13 Thread Andrea Venturoli
On 2/12/22 13:38, Michael Gmelin wrote: Maybe the switch or something it’s connected to uses vrrp? The switch has no options about VRRP, AFAICT (unless it can be called by a different name) and I don't think any other device could use VRRP. When using vhid 1, can you see any vrrp traf

Re: Some strangeness with CARP

2022-02-13 Thread Andrea Venturoli
On 2/13/22 05:34, Thomas Steen Rasmussen wrote: This is absolutely not normal. VHID 1 usually acts the same as the other VHIDs. I also suspect your switch. What is even stranger is that: _ if I boot with VHID 10, then add a different IP with VHID 1, I see both MACs in the switch database; _

Re: Some strangeness with CARP

2022-02-13 Thread Andrea Venturoli
On 2/13/22 11:17, Harry Schmalzbauer wrote: Hi, if source address of the SYN-ACK reply between [C|D] -> carpIP is .3/0:0:5e:00:01:01, Not sure I understand. What's .3? (mac adress learning limit set for the port(s) in question?!?). There's scarcely 10 entries in the whole MAC database

Re: Some strangeness with CARP

2022-02-13 Thread Andrea Venturoli
On 2/13/22 11:51, Michael Gmelin wrote: According to their web site, some of their switches have support (don’t know your model) under IP Application > VRRP > Configuration. No such thing here (it's a GS1900-24E). Good luck getting to the bottom of this! Thanks. I could give up VHID

Re: Some strangeness with CARP

2022-03-14 Thread Andrea Venturoli
On 2/13/22 12:20, Andrea Venturoli wrote: I could give up VHID 1 and just use any other number, but, at least initially, I'll try and check with the vendor out of curiosity. Just for the record: I opened a ticket with Zyxel a month ago and got practically no answer yet. bye av.

Meditation on rl driver

2001-02-08 Thread Andrea Venturoli
Hello. I'd like to share some thought on what happened to me: I had an external ADSL modem from Alcatel connected (with a straight cable, since the device has a reversed ethernet port) to a RealTek card on a FreeBSD 4.1-RELEASE box. I used the simple line in rc.conf: ifconfig_

Re: Meditation on rl driver

2001-02-09 Thread Andrea Venturoli
** Reply to note from Clark Gaylord <[EMAIL PROTECTED]> Thu, 8 Feb 2001 12:46:06 -0500 > It used to be the case that mediaopt half-duplex worked. It stopped > working at some point (I don't recall exactly when ... somewhere > between 4.0 and 4.2 I think), So this IS a bug. > but

  1   2   >