strange network behaviour

[Nathan Kinkade]

On Mon, Jun 06, 2005 at 10:46:33AM -0700, ben at stonehenge-net.com wrote:
> on Friday i set up 4 old celeron boxes as DNS servers for a client.  after
> about 5 minutes, their ability to reach the network vanishes... they can't
> ping their router, and inbound network traffic vanishes.  rebooting fixes
> the problem... for another ~ 5 min.
> 
> the only things running are chrooted bind, postfix, and webmin.  ipfw is
> on, with firewall_type="open".  i've also tried it with ipfw disabled.
> 
> The same thing happens with my laptop, which is also running 5-STABLE as
> of about noon on friday.
> 
> I know this sounds like a network issue, but is there anything in the
> system that might cause thist type of behavior?  it doesn't seem to be the
> hardware - my laptop is a pentium M centrino system with a bg nic, and
> they're old Celeron 500 machines with fxp nics.
> 
> the kernel config is attached, in case i've done something really stupid
> in there
> 
> thanks,
> 
> ben

What is your default rule for IPFW?  I once had a similar problem in a
setup that included an IPFW machine in bridge mode.  I would turn on the
firewall and everything worked fine for about 5 or 10 minutes,
after which everything broke down.  The setup looked like this:

[gateway (cisco)] <--> [ipfw (bridge mode)] <--> [internal net]

It turns out what was happening was that the ipfw machine running
in bridge mode with a default rule of deny was not allowing ARP requests
to pass between the gateway and the internal net.  As soon as the ARP
entries expired on the internal net, access to the external network
broke down because ARP lookups for the gateways IP address were failing
because of the IPFW machine.  In the end we had to set the default IPFW
rule to accept and add two rules before that denying any TCP or UDP
packets.

I'm not sure if this has anything to do with your situation, but I
though I'd throw it out there as one possiblity that involves IPFW.

Nathan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20050606/97d5f42e/attachment.bin