Dropped Packets

Chris Marlatt cmarlatt at rxsec.com
Mon Mar 10 13:35:55 UTC 2008


Lorenz Helleis wrote:
> Do the machines generating the traffic have multiple paths?
> 
> The only time I've really seen pf have problems with sessions is when 
> the devices send and receive traffic via different paths or multiple 
> paths (i.e. traffic comes in via firewall01 but goes out firewall02 and 
> firewall01 and firewall02 do not implement pfsync).
> 
> Regards,
> 
>     Chris
> 
> 
> I have 2 firewalls  , and they were working very good until yesterday...  I implemente pfsync in the firewalls... 
> 
> I think i need to optimize the rules ,  like increase the tables.. or something like this....
> 
> did you increase this values on your firewall ?
> 
> Tell me about your firewall...
> 
> Lorenz.
> 

Please correct me if I'm reading this incorrectly. But it sounds like 
you're saying the firewalls worked fine until you implemented pfsync, is 
this correct?

If so try backing out of that to isolate that change and confirm this. 
I've seen pfsync packets either by lost of "slow" in synchronizing with 
the other firewall and as a result state mismatching occurring on the 
secondary firewall (if both are active - i.e. arp balance). If you're 
using that try disabling it and see if there is an improvement.

Also, have you made any modifications to sysctl.conf and loader.conf? If 
so please post them here.

Regards,

	Chris


More information about the freebsd-pf mailing list