Large scale NAT with PF - some weird problem

[Milan Obuch]

On Sun, 21 Jun 2015 07:19:51 -0400
Ian FREISLICH <ian.freislich at capeaugusta.com> wrote:

> Milan Obuch wrote:
> > Ian FREISLICH <ian.freislich at capeaugusta.com> wrote:
> > 
> > > How many NAT states in your table?
> > 
> > How can I find out? Is there another statistics collected I can gert
> > out of pfctl?
> 
> pfctl -s nat -v
> 
> Ian
> 

My nat rule evaluates into 12 nat 'paragraphs' in this listing,
totalling around 19500 states, plus 4 small nat's with one state, plus
50 binat's with total 1000 states approx.

One observation, on pfctl -vs info output - when src-limit counters
rises to 30 or so, I am getting first messages someone has problem. Is
it only coincidence or is there really some relation to my problem?

Also, could there be some known bug in pf code, which could explain the
behaviour I see? Just for completeness, my system is actually i386
9.3-STABLE #0 r276659: Sun Jan  4 16:36:17, I have 2 GB RAM in my
system.

Regards,
Milan