pf + scrub fragment reassemble + if_bridge = bad?
David Duchscher
daved at tamu.edu
Sat Apr 7 20:16:54 UTC 2007
Ran into a problem the other day and wanted to drop a note and see
if I should followup with a PR. Running a box as a bridging firewall
and ran into problem with giant packets being reported by the router
on one end and OSPF routing dropping. Seems that once a packet is
reassembled by pf, it gets forward on through the bridge and out
onto the wire. In this case, it was an OSPF packet that ended up
being 1540 bytes long . Of course, turning off the scrub rules fix
the problem but I was wondering if this is expected behavior, a
bug, or has already been fix.
The box is running 6.1-RELEASE i386. Network interfaces are em
gigabit interfaces with MTU at 1500.
Thanks,
--
DaveD
More information about the freebsd-net
mailing list