Re: NAT problems 14.3+

I've tried this setup now on three different machines at three different providers, and each time my simple NAT breaks and i'm still clueless on the why. And it prevents me from moving quite a few machines from 14.3 to newer releases. What works fine on 14.3 breaks on 14.4 or newer, which even worse results on 15.0. Even the ipfw nat example from the freebsd manual does not work. I'm sure i cant be the only one with this issue?

Really hope somebody can replicate this for him/herself to confirm this and/or give me a solution for my problem. 

Kind Regards
Rob 

> On 23 Apr 2026, at 12:34, Rob Bloemers <bsd@connectedserver.com> wrote:
> 
> had to quickly upgrade to 14.4 again to return to the broken state. But unfortunately -tso -lro does not change the result.
> 
> ice0: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 9000
> options=4e00028<VLAN_MTU,JUMBO_MTU,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>
> 
> using
> ifconfig_ice0="DHCP mtu 9000 -tso -lro -vlanhwtso -vlanhwtag -vlanhwfilter"
> 
> Inside the jail, the ISP dns stops responding then too strangely. Then when i update it to 1.1.1.1 i can resolve again inside the jail.
> Then when i ping some domain, the first reply i get is from the resolved ip and then i get responses from its own server ip.
> 
> (jail)
> root@x-mysql:~ # ping nu.nl
> PING nu.nl (2.16.245.135): 56 data bytes
> 64 bytes from 2.16.245.135: icmp_seq=0 ttl=50 time=4.603 ms
> 64 bytes from 57.128.x.y: icmp_seq=1 ttl=50 time=4.588 ms
> 64 bytes from 57.128.x.y: icmp_seq=2 ttl=50 time=4.602 ms
> 64 bytes from 57.128.x.y: icmp_seq=3 ttl=50 time=4.602 ms
> 
> Maybe this can be a clue? (i dont remember seeing this before today)
> 
> 
>> On 23 Apr 2026, at 10:22, Andrey V. Elsukov <bu7cher@yandex.ru> wrote:
>> 
>> On 23.04.2026 11:10, Rob Bloemers wrote:
>>> Yes sir, via ifconfig and using sysctl.conf && fresh reboot. Unfortunately no changed.
>>>> 
>>>> Did you try to disable TSO on the ice0 interface?
>> 
>> I'm not sure what you have disabled using sysctl.conf, can you show the output of:
>> 
>> ifconfig ice0 | grep options
>> 
>> -- 
>> WBR, Andrey V. Elsukov
>> 
>> 
> 
>