Re: TCP checksum problems with NAT (maybe vlans/tun)

2014-09-13 Thread Henning Brauer
* Matt Hamilton [2014-09-06 14:11]: > Based on the info above it would seem that the routing table thinks > the packet should be routed to bnx0 based on the IP address. bnx0 > supports HW tcp checksums, so the OS does not create the checksum > itself. > > But the packet never goes out bnx0, it is

Re: TCP checksum problems with NAT (maybe vlans/tun)

2014-09-06 Thread Matt Hamilton
I've been further looking at this, trying to work out where to 'fix' it. Various options seem to be: 1) Get the tun interface to re-calculate the TCP checksums 2) Get pf to have a flag telling it to calculate the checksums always for a given rule 3) Get OpenVPN to calculate the checksums at some

Re: TCP checksum problems with NAT (maybe vlans/tun)

2014-09-04 Thread Matt Hamilton
Matt Hamilton netsight.co.uk> writes: > > Hi All, > I just been upgrading a router from OpenBSD 5.1 to 5.4 and hit a > big problem Doh! I meant 5.5, not 5.4. Digging about it looks like the following change by Henning may shed some light: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/ne

TCP checksum problems with NAT (maybe vlans/tun)

2014-09-04 Thread Matt Hamilton
Hi All, I just been upgrading a router from OpenBSD 5.1 to 5.4 and hit a big problem I'm finding that in certain circumstance TCP packets have incorrect checksums. I know some checksum work was done recently, so maybe something has gone awry (or I've missed something simple). I have OpenVPN list