iRobbery: Any luck? I'm thinking you might want to write to one of the lists, if not.

mason: no, not fully, tcp nat still issues for me. I did find the cause for my 'packet storms'. It's when i had keep-state on the skipto lines, and the nat 1 ip4 from 10.10.2.0/24 ... etc keep-state

(this btw works fine on 14.x and lower)

iRobbery: I'd still recommend going to the lists with all of it - things probably shouldn't have broken just moving from 14 to 15.

yes though i'm always a big believer of that's it probably something i do wrong :) and someway i cant believe i'm the only one using ipfw for nat. Though that said, even the nat in kernel example from the manual doesnt work for me.

bringing kid to school and then doing a little bit more fiddling, and then probably write the list

which list you recommend?

iRobbery: probably lists.freebsd.org/subscription/freebsd-net

Anyway, hitting the sack here. G'night. o/

nn

wew, got FreeBSD 15 installed on my desktop, very nice

on purpose!

!?!?

can anyone point me to a fast mirror for western canada

no hodapp it was an accident

hate when that happens

Mirror bandwidth has always been very variable, ime.

sometimes your acidents tours out to be an improvement

ivy: probably the fastetst to ways to protect NFS traffic is either IPsec transport mode if you happen to have a NIC that offloads it (iirc Connect X5/X6)

or kTLS for more normal NICs (or failing that CPUs with AES-NI)

iRobbery: could you share with us an outline/sketch of your ipfw config that isn't working and restate the problem?

(that said i have not upgraded to that version yet, so i haven't seen any such problems yet)

jmnbtslsQE: forums.freebsd.org/threads/freebsd-15-bridge.102377 i wrote a bit here about it, includes most things

if any additional information is wanted, i'm happy to provide that

weird. i don't see what could be causing what you observe..if there is a routing loop, you would see it in tcpdump..but ipfw is mysterious and it can be hard to know by looking at the config. per your last post you've made some progress but you will want to dig more (tcpdump, checking rule counts) to diagnose that. you say nat isn't working from $lannet but ping from $wanip works? or natted ping from

$lannet works but not natted udp/tcp from $lannet?

jmnbtslsQE: indeed, if keep-state is both on the skipto lines and the lower nat line, the packet/byte counter starts increasing like mad, and soon renders the machine dead

though examples that i found, dont have the keep-state on the lower nat line, but if i leave that out, only 'icmp' seems to nat properly. TCP/UDP still show up in ipfw -d output, as known state, but dont fuction

and also this firewall configuration works fine on any bsd machine i have with 14.x or lower

tcpdump at that time of the 'packet' storm shows nothing, so i think its an in kernel activity

but all i want is just NAT to work properly for my jails that dont have internet routed ip :)

i'm just happy i didnt upgrade one of the production machines to 15.0 yet :)

iRobbery: I've pointed some folks at the forum thread you started. Maybe more ideas will flow in.