Hello Jake,
On 08/04/2008, at 11:07 AM, Jacob Yocom-Piatt wrote:
have spent a fair deal of time working with pf and have just seen
what appears to be quite a bizarre problem:
topology is (internet)--pppoe--(openbsd fw - running 4.2-release)--
switch--(wired/wifi router).
a winxp host connected to the wifi router has no problem viewing
webpages, etc, however, a macosx host connected to the wifi router
gets packets randomly (AFAICT) dropped by the openbsd fw. google
seems to load fine on the macosx machine but other sites will not
load with any regularity. the packet dropping has been observed on
the firewall using 'tcpdump -nettvi pflog0' and packets were being
blocked on the internal internal interface, either em2 or vlan2,
until the pf rule 'pass on $int_if' was changed to 'pass on $int_if
no state'. then packets started getting blocked on the external
interface, despite a rule 'pass out on $ext_if' as a catch-all at
the end of the ruleset. the rule that shows as being the blocker is
'block log all', the first rule in the set.
so in essence, i see rules that are not being obeyed in the pf
ruleset, but only for the macosx host and not the winxp one. the
macosx firewall is turned off and i can ssh from the macosx host to
the openbsd fw just fine. i can also ping fine from the macosx
host, so dns and routing are working.
clues as to wtf is going on would be appreciated. can supply more
detailed info on request.
cheers,
jake
I saw something sounding similar with a MacOX X 10.3 (Panther) host
having packet fragmentation issues. In an effort to troubleshoot the
issue I altered the MTU on the Panther host to 1492 appeared to
resolve the issue. Upgrading that mac to 10.4 (Tiger) reset the MTU
to 1500 without the issue reoccuring.
I don't know if that helps, if not you might try posting your pf.conf
and a tcpdump packet capture.
Best wishes,
Damon
