connect(): Operation not permitted
stef-list at memberwebs.com
Thu Jul 3 01:08:33 UTC 2008
Kian Mohageri wrote:
> On Sun, May 18, 2008 at 3:33 AM, Johan Ström <johan at stromnet.se> wrote:
>> On May 18, 2008, at 9:19 AM, Matthew Seaman wrote:
>>> Johan Ström wrote:
>>>> drop all traffic)? A check with pfctl -vsr reveals that the actual rule
>>>> inserted is "pass on lo0 inet from 184.108.40.206 to 220.127.116.11 flags
>>>> S/SA keep state". Where did that "keep state" come from?
>>> 'flags S/SA keep state' is the default now for tcp filter rules -- that
>>> was new in 7.0 reflecting the upstream changes made between the 4.0 and
>>> releases of OpenBSD. If you want a stateless rule, append 'no state'.
>> Thanks! I was actually looking around in the pf.conf manpage but failed to
>> find it yesterday, but looking closer today I now saw it.
>> Applied the no state (and quick) to the rule, and now no state is created.
>> And the problem I had in the first place seems to have been resolved too
>> now, even though it didn't look like a state problem.. (started to deny new
>> connections much earlier than the states was full, altough maybee i wasnt
>> looking for updates fast enough or something).
> I'd be willing to bet it's because you're reusing the source port on a
> new connection before the old state expires.
> You'll know if you check the state-mismatch counter.
> Anyway, glad you found a resolution.
I've been experiencing this "Operation not permitted" too. I've been
trying to track down the problem for many months, but due to the
complexity of my firewalls (scores of jails each with scores of rules),
I wasn't brave enough to ask for help :)
As a work around we started creating rules without state, whenever we
would run into the problem.
Thanks for the pointer about state-mismatch. The state-mismatch counter
does is in fact high in my case (see below). How would I go about
getting the pf state timeout and the reuse of ports for outbound
connections to match? Or is this an intractable problem, that just needs
to be worked around?
Status: Enabled for 13 days 23:55:25 Debug: Urgent
State Table Total Rate
current entries 65
searches 819507771 677.7/s
inserts 1136670 0.9/s
removals 1136605 0.9/s
match 787482855 651.2/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 0 0.0/s
ip-option 0 0.0/s
proto-cksum 0 0.0/s
state-mismatch 748 0.0/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 0 0.0/s
synproxy 0 0.0/s
More information about the freebsd-net