Re: NAT problems 14.3+

From: Rob Bloemers <bsd_at_connectedserver.com>
Date: Thu, 23 Apr 2026 10:34:20 UTC
had to quickly upgrade to 14.4 again to return to the broken state. But unfortunately -tso -lro does not change the result.

ice0: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 9000
	options=4e00028<VLAN_MTU,JUMBO_MTU,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>

using
ifconfig_ice0="DHCP mtu 9000 -tso -lro -vlanhwtso -vlanhwtag -vlanhwfilter"

Inside the jail, the ISP dns stops responding then too strangely. Then when i update it to 1.1.1.1 i can resolve again inside the jail.
Then when i ping some domain, the first reply i get is from the resolved ip and then i get responses from its own server ip.

(jail)
root@x-mysql:~ # ping nu.nl
PING nu.nl (2.16.245.135): 56 data bytes
64 bytes from 2.16.245.135: icmp_seq=0 ttl=50 time=4.603 ms
64 bytes from 57.128.x.y: icmp_seq=1 ttl=50 time=4.588 ms
64 bytes from 57.128.x.y: icmp_seq=2 ttl=50 time=4.602 ms
64 bytes from 57.128.x.y: icmp_seq=3 ttl=50 time=4.602 ms

Maybe this can be a clue? (i dont remember seeing this before today)


> On 23 Apr 2026, at 10:22, Andrey V. Elsukov <bu7cher@yandex.ru> wrote:
> 
> On 23.04.2026 11:10, Rob Bloemers wrote:
>> Yes sir, via ifconfig and using sysctl.conf && fresh reboot. Unfortunately no changed.
>>> 
>>> Did you try to disable TSO on the ice0 interface?
> 
> I'm not sure what you have disabled using sysctl.conf, can you show the output of:
> 
>  ifconfig ice0 | grep options
> 
> -- 
> WBR, Andrey V. Elsukov
> 
>