05:15:29 iRobbery: Any luck? I'm thinking you might want to write to one of the lists, if not. 05:41:59 mason: no, not fully, tcp nat still issues for me. I did find the cause for my 'packet storms'. It's when i had keep-state on the skipto lines, and the nat 1 ip4 from 10.10.2.0/24 ... etc keep-state 05:43:16 (this btw works fine on 14.x and lower) 05:46:24 iRobbery: I'd still recommend going to the lists with all of it - things probably shouldn't have broken just moving from 14 to 15. 05:48:15 yes though i'm always a big believer of that's it probably something i do wrong :) and someway i cant believe i'm the only one using ipfw for nat. Though that said, even the nat in kernel example from the manual doesnt work for me. 05:49:36 bringing kid to school and then doing a little bit more fiddling, and then probably write the list 05:49:45 which list you recommend? 05:50:05 iRobbery: probably https://lists.freebsd.org/subscription/freebsd-net 05:52:24 Anyway, hitting the sack here. G'night. o/ 06:03:14 nn 10:32:37 wew, got FreeBSD 15 installed on my desktop, very nice 10:59:10 on purpose! 10:59:12 !?!? 10:59:30 can anyone point me to a fast mirror for western canada 10:59:35 no hodapp it was an accident 10:59:43 hate when that happens 11:00:14 Mirror bandwidth has always been very variable, ime. 11:00:31 sometimes your acidents tours out to be an improvement 11:12:33 ivy: probably the fastetst to ways to protect NFS traffic is either IPsec transport mode if you happen to have a NIC that offloads it (iirc Connect X5/X6) 11:13:01 or kTLS for more normal NICs (or failing that CPUs with AES-NI) 11:52:14 iRobbery: could you share with us an outline/sketch of your ipfw config that isn't working and restate the problem? 11:52:18 (that said i have not upgraded to that version yet, so i haven't seen any such problems yet) 11:59:55 jmnbtslsQE: https://forums.freebsd.org/threads/freebsd-15-bridge.102377/ i wrote a bit here about it, includes most things 12:00:15 if any additional information is wanted, i'm happy to provide that 12:34:48 weird. i don't see what could be causing what you observe..if there is a routing loop, you would see it in tcpdump..but ipfw is mysterious and it can be hard to know by looking at the config. per your last post you've made some progress but you will want to dig more (tcpdump, checking rule counts) to diagnose that. you say nat isn't working from $lannet but ping from $wanip works? or natted ping from 12:34:54 $lannet works but not natted udp/tcp from $lannet? 13:06:50 jmnbtslsQE: indeed, if keep-state is both on the skipto lines and the lower nat line, the packet/byte counter starts increasing like mad, and soon renders the machine dead 13:07:39 though examples that i found, dont have the keep-state on the lower nat line, but if i leave that out, only 'icmp' seems to nat properly. TCP/UDP still show up in ipfw -d output, as known state, but dont fuction 13:08:06 and also this firewall configuration works fine on any bsd machine i have with 14.x or lower 13:08:51 tcpdump at that time of the 'packet' storm shows nothing, so i think its an in kernel activity 13:09:22 but all i want is just NAT to work properly for my jails that dont have internet routed ip :) 13:10:25 i'm just happy i didnt upgrade one of the production machines to 15.0 yet :) 16:23:08 iRobbery: I've pointed some folks at the forum thread you started. Maybe more ideas will flow in.