misc/112708: ipfw is seems to be broken to limit number of
seal at inar.ru
Wed May 16 11:30:06 UTC 2007
>Synopsis: ipfw is seems to be broken to limit number of connections
>Arrival-Date: Wed May 16 11:30:04 GMT 2007
>Originator: Vyacheslav Silakov
>Release: FreeBSD 6.2-STABLE
FreeBSD fw.inar.ru 6.2-STABLE FreeBSD 6.2-STABLE #3: Fri May 11 15:45:11 MSD 2007 seal at fw.inar.ru:/usr/obj/usr/src/sys/FW i386
ipfw add allow tcp from me to me 25
ipfw add allow tcp from x.x.x.0/19 to me 25 limit dst-port 100
ipfw add allow tcp from any to me 25 limit dst-port 500
works fine with FreeBSD 4.11-STABLE.
However they doesn't work properly after upgrade to 6.2-STABLE.
Our mail server is always heavy loaded. When I'm installing this ipfw rules number of sendmail connections is keeping around selected limit (500-600 sendmail processes. ps -ax| grep sendmail | wc). But after 5-10 minutes of runtime number of sendmail processes is going to 25 and server rejects new smtp connections. 'ipfw -f flush' and ipfw reconfiguration makes smtp-server alive for another 5-10 minutes and so on.
More information about the freebsd-bugs