PF loses states

konradk · Jul 2, 2014

Hello,

I have a problem with pf and NAT.

Almost always morning states are lost. Table state => current entries (from pfctl -si) floats between values i.e. 2000 and 500 states. When I set an IP which is translated, connections are dropped after a few seconds. Below is pfctl -ss output (during TCP transmission)

Code:

# pfctl -ss | grep -i 10.7.100.2
all tcp 79.xxx.xxx.xxx:51048 (10.7.100.2:56851) -> 78.88.xxx.xxx:5001       ESTABLISHED:ESTABLISHED
 # pfctl -ss | grep -i 10.7.100.2
all tcp 79.xxx.xxx.xxx:51048 (10.7.100.2:56851) -> 78.88.xxx.xxx:5001       ESTABLISHED:ESTABLISHED
# pfctl -ss | grep -i 10.7.100.2
all tcp 79.xxx.xxx.xxx:51048 (10.7.100.2:56851) -> 78.88.xxx.xxx:5001       ESTABLISHED:ESTABLISHED
all tcp 79.xxx.xxx.xxx:56520 (10.7.100.2:56850) -> 78.88.xxx.xxx:5001       SYN_SENT:CLOSED
# pfctl -ss | grep -i 10.7.100.2
all tcp 79.xxx.xxx.xxx:56520 (10.7.100.2:56850) -> 78.88.xxx.xxx:5001       SYN_SENT:CLOSED

When I use iperf and UDP connections, it looks like pf closes translation and creates a new one with a new port.

pftop also looks odd, expire time for every state is 00:00:00.

Code:

PR        DIR SRC                                           DEST                                                   STATE                AGE       EXP     PKTS    BYTES
tcp       Out 79.xxx.xxx.xxx:53297                          81.19..xxx.xxx:443                                TIME_WAIT:TIME_WAIT    00:00:10  00:00:00        4      281
tcp       Out 193.xxx.xxx.xxx:51172                           193.109..xxx.xxx:80                               TIME_WAIT:TIME_WAIT    00:00:10  00:00:00        3     1946

/etc/pf.conf:

Code:

set limit { states 100000, frags 10000 }
set optimization aggressive
set loginterface vlan4010
set skip on lo0
set state-policy floating


nat_addr_vlan32="79.xxx.xxx.xxx"
nat_addr_vlan119="79.xxx.xxx.xxx"
nat_addr_vlan15="79.xxx.xxx.xxx"
nat_addr_vlan227="79.xxx.xxx.xxx"


prefix_vlan32="10.7.100.0/24"
prefix_vlan119="{10.7.18.0/24 10.19.18.0/24 10.69.119.0/24 10.9.95.0/28}"
prefix_vlan15="{10.7.33.0/24 10.19.33.0/24 10.69.15.0/24}"
prefix_vlan227="{10.7.133.0/24}"

nat log on vlan4010 from $prefix_vlan32 to ! <nasze> -> $nat_addr_vlan32
nat on vlan4010 from $prefix_vlan119 to ! <nasze> -> $nat_addr_vlan119
nat on vlan4010 from $prefix_vlan15 to ! <nasze> -> $nat_addr_vlan15
nat on vlan4010 from $prefix_vlan50 to ! <nasze> -> $nat_addr_vlan50
nat on vlan4010 from $prefix_vlan227 to ! <nasze> -> $nat_addr_vlan227

A reboot resolves this problem. I tried disable/enable/flush all pfctl and nothing worked. When the system starts up it works properly about 1-2 days (state count does not flap, pf keeps states)

I can paste output with syslog when I set pfctl -x m.

FreeBSD 10.0-RELEASE-p5.

PF loses states

konradk