14.4 breaks in-kernel nat

[emitrofanov]

In You I trust!

After upgrading from 14.3-RELEASE-p9 GENERIC to 14.4-RELEASE-p3 GENERIC I got non-worked in-kernel nat.

I have the FreeBSD host box with a lot of jails. The packet path is that:

cetus (jail) <-> bridge (local net) <-> lupus (jail) <-> bridge (hoster net, ixl interface) <-> uplink to internet <-> badger

I run on the cetus:

echo 1 | nc -N -u -p 55555 badger 5201

and on the badger I see:

IP (tos 0x0, ttl 59, id 43400, offset 0, flags [none], proto UDP (17), length 30)
*.9.0.244.55555 > *.230.26.243.5201: [bad udp cksum 0x893c -> 0x44a5!] UDP, length 2

I try 14.4-RELEASE GENERIC and got the same.

But with 14.3-RELEASE-p9 GENERIC all work as should, and i got

IP (tos 0x0, ttl 59, id 49222, offset 0, flags [none], proto UDP (17), length 30)
*.9.0.244.55555 > *.230.26.243.5201: [udp sum ok] UDP, length 2

Please help me understand what's wrong. Am I missing something or is this a bug in the new system?

Thanks

 

[SirDice]

If NAT wasn't working then the source address wouldn't get translated. It's the same address in both packet dumps, which means NAT works.

You might want to turn off hardware checksumming though.

 

[Kristof Provost]

The report seems to be missing some crucial information (like say what firewall is in use, and what the ruleset it), but my crystal ball is unusually clear of fog today, so I'll suggest you may want to try turning off checksum offloading on your epair interfaces.

(You're running ipfw, where NAT doesn't work with checksum offload enabled, and epair recently got checksum offload improvements that mean it probably breaks now.)