Added by Steven Selph over 9 years ago. Updated over 9 years ago.
100%
Description
using "divert port (max-packets 8)"
This causes pf to throw a syntax error since divert and max-packets don't appear to be valid in this version of pf.
Files
| config.xml (26.2 KB) config.xml | Steven Selph, 10/09/2014 05:08 PM |
Updated by Steven Selph over 9 years ago
Sorry copy and paste issues meant to say
Rules are generated using "divert port (max-packets 8)"
Updated by Renato Botelho over 9 years ago
Could you share your config.xml sanitized?
Updated by Steven Selph over 9 years ago
Attached my config.xml. The l7 portion results in the following /tmp/rules.debug line:
pass in log quick on $GUEST inet proto { tcp udp } from 192.168.2.1/24 to any divert 45164 tracker 1412311190 keep state ( max-packets 8 ) label "USER_RULE"
Updated by Renato Botelho over 9 years ago
max-packets option is missing from pfctl parser. I'm working on a fix
Updated by Renato Botelho over 9 years ago
Applied in changeset 1f237bb460b8ae7a8803adfb3a8b21b485131ab4.
Updated by Steven Selph over 9 years ago
This change seems to only address half the issue. The max-packets option still seems to be missing or is that something that isn't done in the pfsense source? If so I can test it when the next snapshot is built.
Updated by Renato Botelho over 9 years ago
Steven Selph wrote:
This change seems to only address half the issue. The max-packets option still seems to be missing or is that something that isn't done in the pfsense source? If so I can test it when the next snapshot is built.
I already added max-packets to the parser, please try new snapshots that are already available.
Updated by Steven Selph over 9 years ago
This seems to have corrected the syntax issues. There appears to be some performance issues now. I understand some performance hit is to be expected but this pegs my 1GHz CPU to 100% with a single machine loading web pages or requesting DNS. I also noticed that the rules created from the rules.debug don't have the max-packets in them which might explain it.
@92(1412311190) pass in log quick on em2 inet proto tcp from 192.168.2.0/24 to any flags S/SA keep state label "USER_RULE" divert-to 45164
@93(1412311190) pass in log quick on em2 inet proto udp from 192.168.2.0/24 to any keep state label "USER_RULE" divert-to 45164
Updated by Renato Botelho over 9 years ago
Ermal LUÇI, Are you aware of these performance issues?
Updated by Ermal Luçi over 9 years ago
Its expected and resolving this is not in plan for 2.2.
Also that is not what this ticket is about.
Updated by Chris Buechler over 9 years ago
issue here is resolved