From nobody@FreeBSD.org  Mon Jul 23 08:33:35 2012
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 10039106564A
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 23 Jul 2012 08:33:35 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22])
	by mx1.freebsd.org (Postfix) with ESMTP id EF85A8FC18
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 23 Jul 2012 08:33:34 +0000 (UTC)
Received: from red.freebsd.org (localhost [127.0.0.1])
	by red.freebsd.org (8.14.4/8.14.4) with ESMTP id q6N8XYg2030368
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 23 Jul 2012 08:33:34 GMT
	(envelope-from nobody@red.freebsd.org)
Received: (from nobody@localhost)
	by red.freebsd.org (8.14.4/8.14.4/Submit) id q6N8XYHK030367;
	Mon, 23 Jul 2012 08:33:34 GMT
	(envelope-from nobody)
Message-Id: <201207230833.q6N8XYHK030367@red.freebsd.org>
Date: Mon, 23 Jul 2012 08:33:34 GMT
From: "Herbert J. Skuhra" <h.skuhra@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: pf/nat/jails not working if checksum offloading is enabled on fxp0
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         170081
>Category:       kern
>Synopsis:       [fxp] pf/nat/jails not working if checksum offloading is enabled on fxp0
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-net
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jul 23 08:40:11 UTC 2012
>Closed-Date:    
>Last-Modified:  Fri Apr 12 08:40:00 UTC 2013
>Originator:     Herbert J. Skuhra
>Release:        FreeBSD 9.1-PRERELEASE amd64
>Organization:
>Environment:
FreeBSD oslo.ath.cx 9.1-PRERELEASE FreeBSD 9.1-PRERELEASE #0 r238601: Wed Jul 18 22:41:20 CEST 2012     herbert@oslo.ath.cx:/usr/obj/usr/src/sys/OSLO  amd64
>Description:
If checksum offloading is enabled on fxp0 pf/nat does not work properly.
Therefore the network in my jails does not work.

With tcpdump I see SYN packets going out and SYN+ACK packets coming in on fxp0, but connections time out (no ACKs). pflog doesn't show any blocked packets.

I can reproduce this issue on different computers with fxp.
With ipfw/natd it's working.

pf/nat and different nic (e.g: em0) are OK too.

After disabling checksum offloading (ifconfig fxp0 -rxcsum) pf is working. (Thanks to yongari@ for the hint).


>How-To-Repeat:
# ifconfig lo1 create
# ifconfig lo1 10.0.0.10 netmask 0xffffff00
# pf -e -f /root/pf.conf [1]
# nc -s 10.0.0.10 173.194.70.108 25
Connection fails.

[1] My pf.conf:
nat log on fxp0 inet from 10.0.0.0/8 to any -> fxp0
pass in all
pass out all

>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Mon Jul 23 10:10:30 UTC 2012 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=170081 

From: Johan Broman <je.broman@gmail.com>
To: bug-followup@FreeBSD.org, h.skuhra@gmail.com
Cc:  
Subject: Re: kern/170081: [fxp] pf/nat/jails not working if checksum
 offloading is enabled on fxp0
Date: Fri, 12 Apr 2013 10:30:50 +0200

 --001a11c299667b887504da25b87f
 Content-Type: text/plain; charset=ISO-8859-1
 
 Hi!
 
 Getting the exact same problem. No network traffic to my jails.
 
 # uname -a
 
 FreeBSD nexus 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243825: Tue Dec  4
 09:23:10 UTC 2012
 root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
 amd64
 
 Here's part of my pf.cf file
 
 -- snip--
 
 ext_if="fxp0"
 int_if="bge0"
 jail_if="lo1"
 ext_ip="192.168.1.2" # behind a firewall
 int_ip="192.168.0.1"
 jail_net="10.0.0.0/24"
 
 
 scrub in all
 
 nat on $ext_if from !($ext_if) -> $ext_ip
 
 --snip --
 
 I removed rxcsum from fxp0 using:
 
 # ifconfig fxp0 -rxcsum
 
 Now everything works great and jails get network traffic.
 
 Let me know if you need more detailed information.
 
 Thanks
 Johan
 
 --001a11c299667b887504da25b87f
 Content-Type: text/html; charset=ISO-8859-1
 Content-Transfer-Encoding: quoted-printable
 
 <div dir=3D"ltr"><div><div>Hi!<br><br></div>Getting the exact same problem.=
  No network traffic to my jails.<br><br># uname -a<br><br>FreeBSD nexus 9.1=
 -RELEASE FreeBSD 9.1-RELEASE #0 r243825: Tue Dec=A0 4 09:23:10 UTC 2012=A0=
 =A0=A0=A0 root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC=A0 amd6=
 4<br>
 <br></div><div></div><div>Here&#39;s part of my <a href=3D"http://pf.cf">pf=
 .cf</a> file<br><br></div><div>-- snip--<br></div><div><br>ext_if=3D&quot;f=
 xp0&quot;<br>int_if=3D&quot;bge0&quot;<br>jail_if=3D&quot;lo1&quot;<br>ext_=
 ip=3D&quot;192.168.1.2&quot; # behind a firewall<br>
 int_ip=3D&quot;192.168.0.1&quot;<br>jail_net=3D&quot;<a href=3D"http://10.0=
 .0.0/24">10.0.0.0/24</a>&quot;<br><br><br>scrub in all<br><br>nat on $ext_i=
 f from !($ext_if) -&gt; $ext_ip<br><br></div><div>--snip --<br><br></div><d=
 iv>
 I removed rxcsum from fxp0 using:<br><br># ifconfig fxp0 -rxcsum<br><br></d=
 iv><div>Now everything works great and jails get network traffic. <br><br><=
 /div><div>Let me know if you need more detailed information.<br></div><div>
 <br></div><div>Thanks<br>Johan<br></div></div>
 
 --001a11c299667b887504da25b87f--
>Unformatted:
