Re: pf and ICMP in asymmetric routing setups

2012-06-13 Thread Bernd
Am 2012-06-13 09:55, schrieb Insan Praja SW: Hi, On Wed, 13 Jun 2012 08:07:31 +0700, Stuart Henderson wrote: On 2012-06-12, Simon Perreault wrote: On 2012-06-12 14:08, Bernd wrote: I've got two OpenBSD 5.1-stable/amd64 boxes employed which do all the routing for our AS (OpenBGPd and OpenO

Re: pf and ICMP in asymmetric routing setups

2012-06-13 Thread Insan Praja SW
Hi, On Wed, 13 Jun 2012 08:07:31 +0700, Stuart Henderson wrote: On 2012-06-12, Simon Perreault wrote: On 2012-06-12 14:08, Bernd wrote: I've got two OpenBSD 5.1-stable/amd64 boxes employed which do all the routing for our AS (OpenBGPd and OpenOSPFd). I see asymmetric traffic (I thought

Re: pf and ICMP in asymmetric routing setups

2012-06-12 Thread Stuart Henderson
On 2012-06-12, Simon Perreault wrote: > On 2012-06-12 14:08, Bernd wrote: >> I've got two OpenBSD 5.1-stable/amd64 boxes employed which do all the >> routing for our AS (OpenBGPd and OpenOSPFd). I see asymmetric traffic (I >> thought it to be that way), which itself doesn't really create problems.

Re: pf and ICMP in asymmetric routing setups

2012-06-12 Thread Simon Perreault
On 2012-06-12 15:55, Bernd wrote: What might be the easiest solution to have pf not care about states any longer -- using 'keep state sloppy'? Or disabling statefulness entirely (how?)? If you don't need it, just disable pf. echo pf=NO >>/etc/rc.conf.local Sloppy tracking could work. Also chec

Re: pf and ICMP in asymmetric routing setups

2012-06-12 Thread Bernd
Am 2012-06-12 20:24, schrieb Simon Perreault: On 2012-06-12 14:08, Bernd wrote: I've got two OpenBSD 5.1-stable/amd64 boxes employed which do all the routing for our AS (OpenBGPd and OpenOSPFd). I see asymmetric traffic (I thought it to be that way), which itself doesn't really create problems

Re: pf and ICMP in asymmetric routing setups

2012-06-12 Thread Simon Perreault
On 2012-06-12 14:08, Bernd wrote: I've got two OpenBSD 5.1-stable/amd64 boxes employed which do all the routing for our AS (OpenBGPd and OpenOSPFd). I see asymmetric traffic (I thought it to be that way), which itself doesn't really create problems. However, I see problems with ICMP. pf seems to

pf and ICMP in asymmetric routing setups

2012-06-12 Thread Bernd
Hi list, I've got two OpenBSD 5.1-stable/amd64 boxes employed which do all the routing for our AS (OpenBGPd and OpenOSPFd). I see asymmetric traffic (I thought it to be that way), which itself doesn't really create problems. However, I see problems with ICMP. pf seems to drop all but the first