Re: Match rule with scrub options cause some websites to "hang"

2009-11-19 Thread Martin Schröder
2009/11/19 ZPO : > On Thu, Nov 19, 2009 at 05:24:12PM +0100, Martin Schrvder wrote: >> Most Atom boards have only one nic; some have two but I know of none >> that have more than two. Rumour has it that Intel doesn't allow more > > You may google: "Compact desktop network appliance with Intel ATOM

Re: Match rule with scrub options cause some websites to "hang"

2009-11-19 Thread ZPO
On Thu, Nov 19, 2009 at 05:24:12PM +0100, Martin Schrvder wrote: > 2009/11/19 Cor : > > encryption, say, several simultaneous IPSec or ssh users. I'm looking at > > mini-ITX Atom boards as the basis for a multipurpose, CF-booting platform > > (firewall, X-terminal, NAS/backup server) I want to use

Re: Match rule with scrub options cause some websites to "hang"

2009-11-19 Thread Johan Linnér
Martin Schrvder skrev: 2009/11/19 Cor : encryption, say, several simultaneous IPSec or ssh users. I'm looking at mini-ITX Atom boards as the basis for a multipurpose, CF-booting platform (firewall, X-terminal, NAS/backup server) I want to use at work. Each Most Atom boards have only one nic;

Re: Match rule with scrub options cause some websites to "hang"

2009-11-19 Thread Martin Schröder
2009/11/19 Cor : > encryption, say, several simultaneous IPSec or ssh users. I'm looking at > mini-ITX Atom boards as the basis for a multipurpose, CF-booting platform > (firewall, X-terminal, NAS/backup server) I want to use at work. Each Most Atom boards have only one nic; some have two but I

Re: Match rule with scrub options cause some websites to "hang"

2009-11-18 Thread Cor
Here's a brief overview of what I did. If it's not what you are looking for, let me know (or we can take a more detailed discussion off-list). I don't claim to be an expert in this. I did a lot of Googling/reading, and cobbled together my "strategy" from several sources. Even then, I think

Re: Match rule with scrub options cause some websites to "hang"

2009-11-14 Thread corey clingo
That line doesn't seem to cause problems with microsoft.com for me. I poked around on a few of their pages with no issues. Adding "max-mss 1440" does not help with the web sites I do have problems with, however. I think 4.6 has this same syntax as you are used to, but -current, which I'm using,

Re: Match rule with scrub options cause some websites to "hang"

2009-11-10 Thread Sam Fourman Jr.
On Sun, Nov 8, 2009 at 10:32 PM, Cor wrote: > I'm running a late-October post-4.6 snapshot on a new Soekris firewall, and > noticed something peculiar after setting up the rules per the new pf.conf(5) > man page. I had a few lesser-known websites just hang and eventually time > out (the "majors"

Re: Match rule with scrub options cause some websites to "hang"

2009-11-10 Thread Jason Healy
On Nov 8, 2009, at 11:32 PM, Cor wrote: I changed the following rule: match in all scrub (reassemble tcp no-df random-id) to match in all scrub (no-df random-id) and then www.isa.org came up as normal. (This latter match incantation may be useless, or otherwise not make sense; I just

Match rule with scrub options cause some websites to "hang"

2009-11-08 Thread Cor
I'm running a late-October post-4.6 snapshot on a new Soekris firewall, and noticed something peculiar after setting up the rules per the new pf.conf(5) man page. I had a few lesser-known websites just hang and eventually time out (the "majors" still work fine), but thought little of it until