00:00:01 specialbomb: nope I removed them all lol 00:00:02 mason, I use mpv for command line everything. 00:00:09 either you love it or you hate it 00:00:27 rwp: Ah, I thought of it as not being console-based. Will try it. Thank you. 00:01:45 oh someone please shoot me I cant take this anymore 00:03:53 polarian: I knew you were gonna say that :/ 00:04:09 hah 00:05:38 mason: should be included with multimedia/vlc 00:06:19 rtprio: It's a build option that's off by default. If I build the port I can turn it on. 00:07:35 well, building it by hand is not much effort 00:07:57 but mpg123 is one i used a long time ago 00:08:06 https://bpa.st/KCWA 00:08:08 seen this issue before 00:08:12 its definitely state 00:08:18 but whats causing this... 00:08:22 ugh :( 00:09:08 polarian: what's the problem exactly? 00:09:19 rtprio: stateful packets getting dropped 00:09:22 as they arent stateful 00:09:59 packet goes from a vnet jail, to host, where it is NAT, passed out to WAN via wg0, then the reply comes in on wg0 and then is blocked by "block log" within the firewall 00:10:14 stateful packets are passed without firewall 00:10:24 but as the pastebin shows, the state is not being established 00:13:40 did you share your rules too? 00:13:40 what happens when you do bare minimum and just do the nat rule? 00:15:23 also, what do your routes look like? 00:15:42 rtprio: further up yeah 00:16:08 but theres nothing let, I stripped the config right down, I didnt think any of the extras were the problem but had to make sure 00:16:22 its a basic nat, passing on packets from the epair, and then passing them out 00:16:37 ig I remove wg next 00:17:30 oh yeah I remember, it is wg which is causing the issue 00:17:39 but I fixed it somehow ages ago 00:18:18 mtu on the wg? 00:18:27 rtprio: doubt its mtu being a pain but sure 00:18:39 it defaults to a sane value but its certainly not mtu 00:18:44 MTU is 1300 00:18:52 the default doesn't work :) 00:18:56 I have no clue why 00:18:59 no it does not 00:19:04 1420 is the default and it ends up dropping the packets 00:19:11 I found ~1300 doesnt cause issues 00:19:24 this was ages ago, wireguard as a whole on wireguard is duct tape at best 00:19:53 wait, wg on wg? 00:20:32 does your jail also contain a tunnel? 00:20:39 block log all, blocks in AND out 00:21:00 specialbomb: no 00:21:02 only the host 00:21:16 tf: I am aware... 00:21:29 but pf is a stateful firewall 00:21:59 you usually start pf rules with block all, further rules modify whats allowed 00:22:02 so if you block in, but your device connects to say google.com, there is tcp state 00:22:10 the returning packet matches the state, and doesn't go through pf 00:22:19 polarian: you dont state keep state, are you sure it is? 00:22:31 keep state is default 00:22:33 tf: keep state is the default 00:22:50 no offence, but I have used pf for years... I know my way around the firewall :) 00:23:26 this is an edge case im trying to remember how I solved before :P 00:25:04 so remind me, packets are not getting to the wireguard interface, and its not that decaped packets arent getting to the origin? 00:25:41 specialbomb: wireguard is functioning just fine, everything on the host works fine 00:25:49 the issue is specifically the state when it comes to the NAT 00:26:01 I know this because if I drop the firewall block, the packet is still dropped 00:26:01 rtprio: FWIW, rwp sold me on mpv. It seems to do everything I want. 00:26:06 sorry, the state relating to the nat 00:26:13 if you look at the paste I sent 00:26:16 https://bpa.st/KCWA 00:26:21 this is produced with wireguard 00:26:26 as you can see the state is never established 00:26:38 the state should look like.. one sec lemme grab log 00:27:19 could I ask what your vpn provider is 00:28:27 specialbomb: my router xD 00:28:33 wait, no that shouldnt matter in this case I think... 00:28:39 no it shouldnt 00:28:45 as the packets pass in and out of the wg interface 00:28:46 theres this weird edge case with OVPN 00:28:53 but thats besides the point 00:29:04 I just for the life of me want to remember how I solved this issue a year ago 00:29:06 so badly 00:30:08 in your state log, what are the addresses? I guess thats whats confusing me. its obvious which is the wg if but its unclear what the rest represent 00:33:39 i think my server issue was bad ram 00:33:57 good time to have ram go bad after its price goes up 400% 00:34:19 I forgot xfce can kinda use wayland 00:34:21 sorry man :( 00:34:30 specialbomb: 192.168.254.1 is jail, 34.160.111.145 is ifconfig.me, 192.168.4.2 is the addr assigned to wg 00:34:31 ty 00:34:35 should make sense now 00:34:46 kerneldove: this is why I keep spares :) 00:34:46 https://share.katzenmue.de:9270/file_share/0691d109-a10b-7144-a610-683db6e3a88d/20251118_193424.jpg 00:34:50 Cursed 00:34:55 ram and disks are useful to have spares 00:35:01 motherboards and cpus sometimes come in use 00:35:22 especially if you have butterfingers like me and drop a disk onto your motherboard and fry it 00:35:23 oh i have lots of spares for my home servers, these are datacenter servers so the hosting company has to eat the cost 00:35:27 polarian: in that case, where is your endpoint wg peer? 00:35:28 im sure they have spares too tho 00:35:34 specialbomb: irrelevant 00:35:44 i have a hoard of sas drives, ram sticks, etc 00:35:45 but 192.168.4.1 00:35:55 on your local network then? 00:36:14 oh I thought you meant the address on the wireguard end 00:36:29 the IP address of the router is 192.168.2.1 :) 00:36:32 because this is local 00:36:45 if I was out of the house it would be the NAT addr of the router 00:37:06 I reserve the other IPv4's I have for statically assigning to servers on separate vlans 00:37:19 something which has been a pain to setup and still not working either :P 00:37:21 so, the encapsulated traffic IS coming back from your router then? 00:37:33 whether encapsulated or not, it passes through the router 00:37:35 yes 00:37:35 just getting blocked? 00:37:38 no 00:37:45 the router has nothing to do with it 00:37:53 as I said, the tcpdump shows the HOST is dropping it 00:38:04 ignore anything else, its exclusively the host 00:38:05 okay good, thats just what I wanted to clarify 00:38:14 no wg, state works fine 00:38:17 with wg, state breaks 00:38:18 im a littlw retarded btw 00:38:33 and I remember having this exact issue, which is why it is pissing me off so much 00:38:36 I literally sloved it 00:38:51 I remember this same suffering before ugh 00:38:54 im trying hard to try and sort out why exactly state isnt being established... 00:39:41 I do know when I was routing traffic between my jails, I had to establish bidirectional rules 00:40:02 theres bidirectional rules dw 00:40:05 but thats in the case of external traffic initiating a connection 00:40:08 "route show" shows all the routes I need 00:40:10 no problem 00:41:36 the host will always know how to get to the jail, but there is a catch which took me ages to figure out, which was if you have a vm within the jail, you need a route for the /29 block to the IP of the epair iface within the jail 00:41:54 this means the host will not know how to reach the vm, but it has a route to pass it back to the jail 00:41:57 and the jail does know 00:41:59 so it routes fine 00:42:15 most people use bridge though, which makes things simpler, but routed is more secure 00:42:56 some people think using cloudflare is secure until it takes down half the internet 00:43:15 cpet: therefore the answer is clear 00:43:42 turn the pc off ? 00:43:45 cpet: lol 00:43:58 and until they realise cloudflare is decrypting (and likely storing) all their encrypted packets :P 00:44:10 sounds like a security vulnerability to me, not a security improvement 00:44:11 cpet: fuck cloudflare!!! 00:44:15 s/improvement/layer/ 00:44:17 polarian: most big companies do that 00:44:17 scottpedia: agreed 00:44:26 cpet: which is why you should avoid them :) 00:44:32 google does it, apple does it 00:44:56 cf is basically a protection fee racket 00:45:00 polarian: does it as well 00:45:13 pay or be denied access 00:45:24 scottpedia: pay me then 00:45:46 anyways back to smashing my head against the table 00:45:59 you cant multitask ? 00:46:02 well you ain't Lee Holloway are you? cpet 00:46:14 polarian: this is partially why I also do routing instead of bridges, but for me its mostly that I think routing gives you much greater control and a lot less overhead than having to worry about l2 specifics 00:46:50 scottpedia: i dont like cloudflare so no 00:47:24 specialbomb: which is why I did it too 00:47:27 I wanted control of the packet flow 00:47:32 but on a basic level, its easy 00:47:42 start slapping different virtual interfaces in, and multiple physical 00:47:44 and shit goes bad :/ 00:47:46 cool theres a bill that would require cursive learning in schools 00:47:47 heh 00:48:03 cpet: where? 00:48:08 Florida 00:48:11 lol 00:48:29 cpet: they don't teach that by default where I went to school 00:48:40 they did when I was in 00:48:43 40 years ago 00:48:58 why would you want people forced to learn cursive writing 00:49:13 cause its quicker fancier and better 00:49:19 polarian: be sure to let me know your solution if you remember, im pissed I cant figure it out :D 00:49:23 just like your routed approach 00:49:26 that's not a good idea since i can't read a lot of old folks' note 00:49:53 specialbomb: I will prob be braindead by then 00:50:09 if it works leave it alone (TM) 00:50:50 cpet: Florida is a nice place btw 00:51:24 they drive like crap though 00:51:34 drive? 00:52:01 you know large box looking thing with 4 wheels on it that goes zoom zoom ? 00:52:02 as in motoring? 00:52:45 polarian: We are making my kids learn cursive. 00:52:46 hrm 00:52:49 okay hard to figure how "crap" it could be 00:53:31 sometimes cursive should be the first writing to teach a kid mason 00:53:58 look at how things were done a centeury or so ago 00:54:41 i remeber a time when kids went outside and not doing dumb shit on tiktok 00:55:43 and I remeber when I was 9 and some lady called me up telling me she hit my dog and I carried it home and my brother sprayed it with ant spray and it was as stiff as taxodermy 00:55:45 thank god I was the last gen to ever go outside 00:55:50 but now its all social media or tiktok 00:56:10 my cousins and stuff were ph@cked hard by the following wave of crap "apps" 00:56:28 a time when downloading a vidoe took hours 00:57:00 a time when you only had to worry about durnk drivers not drunk, high, texters 00:57:01 heh 00:57:06 Is there a "default/most used" DE/WM in FreeBSD (out of curiosity) 00:57:27 Lumina was the one pcbsd came with 00:57:31 think it died 00:57:39 gnome is popular I hate it 00:57:46 xfce4 and KDE are my personal favs 00:57:53 I heard about something called xenocara 00:58:03 thats openbsd x11 suite 00:58:11 Oh did you see my cursed xfce Wayland pic 00:58:33 nope 00:58:37 mason: why? lol 00:58:46 JetpackJackson: I believe KDE is the most popular 00:58:46 if it snot jennifer connley riding that horse 00:58:49 i dont want to see it 00:58:50 heh 00:59:02 but freebsd is not commonly ran on the desktop 00:59:04 polarian: Why prevent them from being able to read some decent percentage of written communications? 00:59:06 gnome's graphics is over-simplified 00:59:16 cpet: https://share.katzenmue.de:9270/file_share/0691d109-a10b-7144-a610-683db6e3a88d/20251118_193424.jpg 00:59:16 wifi issues, software issues 00:59:17 shit just segfaults lol 00:59:24 polarian: freebsd runs nice as a desktop you just have to pick your HW right 00:59:42 I get i3 and python (gajim) segfault often 00:59:55 gajim is horrible 00:59:58 true 01:00:02 Gajim is garbage 01:00:03 dino segfaulted in the past too 01:00:11 I say as someone who uses it lmao 01:00:15 Linux software written for LInux 01:00:17 not meant to run on BSD 01:00:32 but then again i never liked jabber 01:00:38 i miss gaim 01:00:40 Can't wait until I'm not behind a cgnat, then I can use websockets and use Cheogram web 01:01:05 God I want a framework laptop lol 01:01:13 jabber as in the chat protocol? 01:02:05 last I remeber XMPP is jabber 01:02:15 JetpackJackson: websockets work with CGNAT Lol 01:02:16 last I used gajim was for that 01:02:22 well depends 01:02:27 do you mean the server side, or client side 01:02:33 now i think its a multi chat thing like pidgin 01:03:10 polarian: im connecting to singpolyma's server to bypass the CGNAT so my DNS is set to his server 01:03:34 JetpackJackson: I dont know what you are saying lol 01:03:46 CGNAT prevents you hosting things 01:03:47 it's too complicated a thing... just use IRC if it's not for some extra-important stuff. cpet 01:03:50 it does not prevent you connecting to websockets 01:04:01 websockets are just sockets but HTTP based 01:04:13 if websockets are blocked by CGNAT so would regular sockets 01:04:22 Hmm 01:04:25 https://prosody.im/doc/websocket 01:04:30 I guess I'll look into it again 01:04:33 oh you mean hosting it yourself? 01:04:44 are you trying to host on a CGNAT 01:04:47 if so then sure, it wont work 01:04:56 but connecting to a websocket via CGNAT works fine 01:04:57 love it when people on residential want to host crap then get fussy when you just need to get a biz line 01:05:03 Yeah im behind a cgnat 01:05:13 That's why I'm sshing into the other server 01:05:16 JetpackJackson: not the answer to my question 01:05:22 still not the answer 01:05:34 the answer is $@ 01:05:35 I don't understand then 01:05:42 are you trying to host prosody on your home network 01:05:48 or are you trying to connect to prosody on another network 01:06:15 The first one 01:06:34 why dont you get a VPS for 5/m 01:06:37 and host it on that ? 01:06:38 I _am_ hosting it, I just can't do websockets 01:06:55 cpet: because singpolyma lets me use his server and it's free 01:07:08 And I can run it on my own hardware at home 01:07:20 no you cant 01:07:20 Just have to ssh for connection stuff 01:07:32 according to what youre saying about CGNAT 01:07:35 you can not 01:07:50 if you have to connect to server y to connect to server z through sing whatever server 01:07:53 you can't 01:07:58 I use autossh to connect to him 01:08:25 It works. It's how im talking here cause I'm using a xmpp-irc bridge 01:08:27 Lol 01:08:35 man people like you are the reason why ISP's have to do all this crap in the first place 01:08:47 ... what? 01:08:52 not really? IP address exhaustion is why CGNAT exists 01:08:54 What'd I do?? 01:10:09 JetpackJackson: I'm not entirely sure that person's game. But yeah you probably do need to get a VPS, since you don't have a public IP. You can use the VPS solely for tunnelling if you want, but it rmains that you need to do it. 01:10:11 cpet: they used to give up full ipv4 address with all non-standard ports open 01:10:17 us* 01:10:45 my ISP still does that 01:10:45 JetpackJackson: so you are forwarding traffic over ssh 01:10:49 through to singpolyma's server 01:10:52 except for port 25 01:10:53 LxGHTNxNG: oh. I guess I'm using the other server as a tunnel 01:10:56 why the fuck is singpolyma letting you relay off his server 01:11:02 pity 01:11:04 probably 01:11:05 and if you have cgnat, then you obviously cant host 01:11:11 polarian: not without help, no 01:11:13 pay for a VPS, setup wireguard on it, and tunnel through it 01:11:15 but again they limit the upstream speed so it isn't that useful anyways 01:11:20 or, just host everythign on the vps 01:11:21 polarian: because he's nice? 01:11:32 JetpackJackson: its not a very good setup im sorry 01:11:33 if you can't afford 5/m 01:11:38 really heh 01:11:45 5 which? galactic credits? 01:11:52 Lol I wish 01:11:59 JetpackJackson: wish what? 01:12:00 are you allergic to the shift key cpet? 01:12:03 I want a lightsaber 01:12:06 Lol 01:12:18 shift keys are bad 01:12:23 cpet: we used to be on 600Mbps-duplex for 15CAD/m with ALL PORTS OPEN for some reason 01:12:30 well, glad I could be of humour at least. stay safe y'all. *dragon flies away* 01:12:41 Lol 01:12:50 I was floodfilling i2p like crazy these days 01:13:02 See ya later LxGHTNxNG 01:13:55 scottpedia: a ISP shouldnt filter anything 01:14:08 most services are behind a nat firewall which is secure enough for most home users 01:14:09 yes that's ideal 01:14:19 and they should give us dynamic addresses too 01:14:28 I should learn how pf works 01:14:32 shoudn't* 01:14:35 i have a dyn IP but it hasnt changed for 3 yrs heh 01:14:35 And try out bhyve 01:14:45 JetpackJackson: vm-bhyve 01:14:57 Yeah 01:14:59 cpet: yeah some lazy employee might forget to turn the rotation up 01:15:15 I don't know how much ram or cpu it needs though 01:15:35 freebsd will run fine on 1gig of ram and 60gb space 01:16:14 wouldnt recomend running it with zfs but it can be tuned to work with 1gig 01:16:50 Im using ufs cause of the ram issue 01:17:20 I think the CPU is a bottleneck 01:17:23 why dont you just run freebsd over hyper-v ? 01:17:24 Celeron 01:17:25 or KVM 01:17:36 JetpackJackson: zfs doesnt have high ram usage 01:17:46 cpet: a VM on a Linux host? 01:17:50 I wanna run bare metal 01:17:57 is dead | cpets is dead 01:18:11 it uses spare ram for ARC cache 01:18:13 ARC: 5964M Total, 2762M MFU, 2102M MRU, 264K Anon, 38M Header, 1059M Other 4248M Compressed, 6966M Uncompressed, 1.64:1 Ratio 01:18:30 zfs isnt a ram hog my ass 01:18:31 hah 01:18:45 polarian: this is the laptop im running FreeBSD on: https://bsd-hardware.info/?probe=221eed4850 01:19:24 ugh 01:19:27 I cant load the site 01:19:32 its slow 01:19:34 very slow 01:19:36 but it works 01:19:46 Yeah idk why it's so slow 01:20:02 NAT is not a firewall 01:20:12 probably cause they run it off there home DSL service 01:20:13 4GB of memory is more than enough for zfs 01:20:14 ;P 01:20:19 like cpet pointed out 01:20:22 1GB is enough 01:20:27 DSL is olde xD 01:20:29 LxGHTNxNG: never said it was 01:20:30 just you wont get a large ARC cache but thats fine 01:20:34 JetpackJackson: celeron which? 01:20:45 which codename/rlease year? 01:20:50 LxGHTNxNG: I have DSL :) 01:21:18 does zfs cost that much ram? 01:21:20 LxGHTNxNG: https://www.intel.com/content/www/us/en/products/sku/189309/intel-celeron-processor-4205u-2m-cache-1-80-ghz/specifications.html 01:21:33 scottpedia: yeap 01:21:47 you talking about having encryption-enabled 01:21:49 ? 01:21:52 scottpedia: its mainly used for arc cache, I dont see a sizable difference in mem use between zfs and ufs 01:22:07 ARC: 13G Total, 9690M MFU, 2023M MRU, 896K Anon, 173M Header, 1544M Other 10G Compressed, 21G Uncompressed, 2.05:1 Ratio 01:22:15 thats the desktop with 64 gigs of ram 01:22:17 LxGHTNxNG: 2x Celeron CPU 4205U @ 1.80GHz 01:22:18 cpet: ARC only uses SPARE memory 01:22:24 ARC shrinks with memory use 01:22:30 cpet: damn 64GB ram???? 01:22:48 And here I was thinking 16GB was plenty 01:23:01 they had a special one day for veterans day 01:23:06 so i bought some ram 01:23:24 regardless of how zfs arc works 01:23:29 zfs is a ram hog 01:23:58 unused memory is wasted memory 01:24:05 zfs makes good use of spare memory 01:24:59 Alright 01:25:20 imo functionally zfs is not so different from lvm so it shouldn't be a burden on just the typical HW of laptops and servers 01:26:25 I used to do lvm on a t3.micro 01:27:39 zfs can be tuned nicely on systems with less ram, it is mostly arc. you can change that easily 01:27:56 Hmm as long as I don't touch xwayland niri will work, it's when I try to run xwayland it just does not work 01:28:02 Sorry my brain is all over 01:28:11 Zfs and Wayland and websockets 01:28:13 Sorry 01:29:27 I've found that I do need to limit ARC to be able to deal with non-ARC memory allocations. More so on illumos because its memory allocator is broken 01:30:06 Interesting 01:32:59 scottpedia: lvm and zfs are entirely different 01:33:16 just because zfs can do what lvm does, doesnt mean they are similar 01:33:27 lvm is just volumes, its not a filesystem 01:33:49 "functionally" polarian 01:33:59 scottpedia: functioning how? 01:34:13 say im installing an OS, I am not going to slap LVM on it as the filesystem am I? 01:34:20 but if I was installing BSD I would select zfs.. 01:34:25 comparing apples with oranges IMP 01:34:27 IMO* 01:34:39 Apple and orange are both fruit, but that doesnt make them simialr 01:34:41 similar( 01:34:45 I said "functionally" they are not so different 01:35:12 lol well tbh this isnt really worth arguing over xD 01:35:15 nitpicking a little :P 01:35:20 apologies 01:35:41 okay it's alright 01:35:48 but is LVM not a filesystem? 01:35:56 nope 01:36:21 there is a flag for a given partition that says "linux-lvm" as I remember 01:36:36 theres a flag that says freebsd-zfs as well 01:37:02 i would classify LVM like raidframe 01:37:21 scottpedia: it cant store data 01:38:00 I understand that but doesn't lvm dwell under a raw partition and emualates the recognized VGs on loopback? 01:38:01