From nobody Thu Apr 23 10:34:20 2026 X-Original-To: freebsd-ipfw@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g1XXD2fD5z6ZQCd for ; Thu, 23 Apr 2026 10:34:36 +0000 (UTC) (envelope-from bsd@connectedserver.com) Received: from mail.mailboxbox.com (mail.mailboxbox.com [195.154.48.128]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4g1XXB5Rm9z3CDY for ; Thu, 23 Apr 2026 10:34:34 +0000 (UTC) (envelope-from bsd@connectedserver.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=connectedserver.com header.s=dkim header.b=NA1nPIHm; dmarc=none; spf=pass (mx1.freebsd.org: domain of bsd@connectedserver.com designates 195.154.48.128 as permitted sender) smtp.mailfrom=bsd@connectedserver.com Received: from mail.mailboxbox.com (localhost [127.0.0.1]) by mail.mailboxbox.com (Postfix) with ESMTP id 4g1XX90yttzFQFk for ; Thu, 23 Apr 2026 10:34:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d= connectedserver.com; h=x-mailer:message-id:in-reply-to:to :references:date:subject:mime-version:content-transfer-encoding :content-type:from; s=dkim; t=1776940471; x=1777804472; bh=u0jFE Hf+bqDaU/Shdlw4q5VNsCFJK36++4MnS078p/w=; b=NA1nPIHm8qOmrxWUeQjwS pVFnQaAZeBqnhSvcE+VZw42chQC9iGmtrx5B6kfdFWE7WO5Q9IU1CaudEI+BGyLm KNZEyScEbz/cfzmutLUFkZc9hiKs8QJk+EdGBqjAyFLdbSkROaqIy4VLQsY+T6Ec whZAndl3YeNKeEa2P7Dg54= X-Virus-Scanned: amavis at mail.mailboxbox.com Received: from mail.mailboxbox.com ([127.0.0.1]) by mail.mailboxbox.com (mail.mailboxbox.com [127.0.0.1]) (amavis, port 10026) with ESMTP id Gxz3hW4yjEpU for ; Thu, 23 Apr 2026 10:34:31 +0000 (UTC) Received: from smtpclient.apple (216-244-98-95.ftth.glasoperator.nl [95.98.244.216]) by mail.mailboxbox.com (Postfix) with ESMTPSA id 4g1XX71HVYzFQ3f for ; Thu, 23 Apr 2026 10:34:31 +0000 (UTC) From: Rob Bloemers Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable List-Id: IPFW Technical Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-ipfw List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-ipfw@FreeBSD.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.400.21\)) Subject: Re: NAT problems 14.3+ Date: Thu, 23 Apr 2026 12:34:20 +0200 References: <27FFB189-7608-4A97-AD87-21EC64CBC975@connectedserver.com> <30c2d1b4-d96e-4e25-b2d9-264fdcda2d7e@yandex.ru> <09e445e7-bea5-41cb-9ffc-9e1268a142de@yandex.ru> To: freebsd-ipfw@freebsd.org In-Reply-To: <09e445e7-bea5-41cb-9ffc-9e1268a142de@yandex.ru> Message-Id: <1614DF5F-C565-40AA-A85C-F52A9B9FAA3B@connectedserver.com> X-Mailer: Apple Mail (2.3864.400.21) X-Spamd-Result: default: False [-3.50 / 15.00]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.998]; R_DKIM_ALLOW(-0.20)[connectedserver.com:s=dkim]; R_SPF_ALLOW(-0.20)[+mx]; MIME_GOOD(-0.10)[text/plain]; DKIM_TRACE(0.00)[connectedserver.com:+]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; RCVD_TLS_LAST(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; DMARC_NA(0.00)[connectedserver.com]; FREEFALL_USER(0.00)[bsd]; RCVD_VIA_SMTP_AUTH(0.00)[]; ARC_NA(0.00)[]; TO_DN_NONE(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; ASN(0.00)[asn:12876, ipnet:195.154.0.0/16, country:FR]; PREVIOUSLY_DELIVERED(0.00)[freebsd-ipfw@freebsd.org]; MID_RHS_MATCH_FROM(0.00)[]; MLMMJ_DEST(0.00)[freebsd-ipfw@freebsd.org]; APPLE_MAILER_COMMON(0.00)[]; MIME_TRACE(0.00)[0:+] X-Rspamd-Queue-Id: 4g1XXB5Rm9z3CDY X-Spamd-Bar: --- had to quickly upgrade to 14.4 again to return to the broken state. But = unfortunately -tso -lro does not change the result. ice0: = flags=3D1008943 = metric 0 mtu 9000 = options=3D4e00028 using ifconfig_ice0=3D"DHCP mtu 9000 -tso -lro -vlanhwtso -vlanhwtag = -vlanhwfilter" Inside the jail, the ISP dns stops responding then too strangely. Then = when i update it to 1.1.1.1 i can resolve again inside the jail. Then when i ping some domain, the first reply i get is from the resolved = ip and then i get responses from its own server ip. (jail) root@x-mysql:~ # ping nu.nl PING nu.nl (2.16.245.135): 56 data bytes 64 bytes from 2.16.245.135: icmp_seq=3D0 ttl=3D50 time=3D4.603 ms 64 bytes from 57.128.x.y: icmp_seq=3D1 ttl=3D50 time=3D4.588 ms 64 bytes from 57.128.x.y: icmp_seq=3D2 ttl=3D50 time=3D4.602 ms 64 bytes from 57.128.x.y: icmp_seq=3D3 ttl=3D50 time=3D4.602 ms Maybe this can be a clue? (i dont remember seeing this before today) > On 23 Apr 2026, at 10:22, Andrey V. Elsukov wrote: >=20 > On 23.04.2026 11:10, Rob Bloemers wrote: >> Yes sir, via ifconfig and using sysctl.conf && fresh reboot. = Unfortunately no changed. >>>=20 >>> Did you try to disable TSO on the ice0 interface? >=20 > I'm not sure what you have disabled using sysctl.conf, can you show = the output of: >=20 > ifconfig ice0 | grep options >=20 > --=20 > WBR, Andrey V. Elsukov >=20 >=20