Re: Tun and ALTQ

2005-11-08 Thread Brian Fundakowski Feldman
On Wed, Nov 09, 2005 at 02:44:09AM +0100, Marko Cuk wrote: > Max, tnx for explanation and others to help. > > Second thing is route-to routing capability of pf. > I have one dual homed firewall and the configuration is very > complicated, because I must have two NAT's ( certain subnets through on

Re: kern/84370: [modules] Unload pf.ko cause page fault

2005-11-08 Thread Ricardo A. Reis
The following reply was made to PR kern/84370; it has been noted by GNATS. From: "Ricardo A. Reis" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED], [EMAIL PROTECTED] Cc: Subject: Re: kern/84370: [modules] Unload pf.ko cause page fault Date: Tue, 08 Nov 2005 20:24:16 -0200 hi mlaier, I've this pro

Re: continuing issue with ftp from gateway

2005-11-08 Thread Michael VInce
I was having trouble implementing the ftp-proxy daemon as well I got it working after doing a few things, I upgraded to 6.0 (its a old U1 Sparc64 Sun netra) I discovered from the pf.conf man that it says "the use of the group and user filter parameter in conjunction with a Giant-free netstack can

Re: Tun and ALTQ

2005-11-08 Thread Tom Rhodes
On Tue, 8 Nov 2005 19:45:59 +0100 Max Laier <[EMAIL PROTECTED]> wrote: > On Tuesday 08 November 2005 18:15, Brian Fundakowski Feldman wrote: > > On Tue, Nov 08, 2005 at 02:39:02PM +0100, Marko Cuk wrote: > > > It seems that it work. Thanks. > > > > > > Damn, for vlan's ( 802.1Q) you should specif

Re: Tun and ALTQ

2005-11-08 Thread Max Laier
On Tuesday 08 November 2005 18:15, Brian Fundakowski Feldman wrote: > On Tue, Nov 08, 2005 at 02:39:02PM +0100, Marko Cuk wrote: > > It seems that it work. Thanks. > > > > Damn, for vlan's ( 802.1Q) you should specify "em", for "tun", vice > > versa... what a mess, hehe. > > No prob; I don't see w

continuing issue with ftp from gateway

2005-11-08 Thread Dave
Hello, I'm still having issues with ftp. I've got a 6.0 machine acting as a firewall/gateway for my network of natted machines. Machines behind the gateway can ftp passively just fine, active no. The gateway can't do either or. I've run some tcpdump and the block by default rule is stoppi

Re: Tun and ALTQ

2005-11-08 Thread Brian Fundakowski Feldman
On Tue, Nov 08, 2005 at 02:39:02PM +0100, Marko Cuk wrote: > It seems that it work. Thanks. > > Damn, for vlan's ( 802.1Q) you should specify "em", for "tun", vice > versa... what a mess, hehe. No prob; I don't see why using the em(4) backing the tun(4) wouldn't work for ALTQ _IF_ you actually

Re: kern/84370: [modules] Unload pf.ko cause page fault

2005-11-08 Thread Max Laier
Synopsis: [modules] Unload pf.ko cause page fault State-Changed-From-To: open->feedback State-Changed-By: mlaier State-Changed-When: Tue Nov 8 17:01:24 GMT 2005 State-Changed-Why: Can you provide a trace or at least an IP + related source code for this? Responsible-Changed-From-To: freebsd-bugs

Re: i386/86072: [pf] Packet Filter rule not working properly (with SYNPROXY option)

2005-11-08 Thread Max Laier
Synopsis: [pf] Packet Filter rule not working properly (with SYNPROXY option) State-Changed-From-To: open->feedback State-Changed-By: mlaier State-Changed-When: Tue Nov 8 16:51:34 GMT 2005 State-Changed-Why: In order to debug this problem, more information is required. Can you please discuss wit

Re: kern/88362: [pf] [panic] carp with pfsync causing system crash, dump debug attached

2005-11-08 Thread Max Laier
Synopsis: [pf] [panic] carp with pfsync causing system crash, dump debug attached State-Changed-From-To: feedback->closed State-Changed-By: mlaier State-Changed-When: Tue Nov 8 16:48:44 GMT 2005 State-Changed-Why: Fixed in RELENG_5 and later as confirmed by originator - Thanks. http://www.freeb

Re: PF "keep state" for ICMP

2005-11-08 Thread Daniel Hartmeier
On Mon, Nov 07, 2005 at 11:42:36PM -0800, Alberto Alesina wrote: > My question is - would *only* ICMP echo *replies* be > allowed back against that state? Or, would *any* ICMP > traffic with the corresponding ICMP ID, source address > and destination address be allowed? The latter. > If *any* I