Added by Chris Buechler about 12 years ago. Updated over 11 years ago.
0%
Description
There's some kind of state mismatch issue on enc0 with amd64. Potentially related, tcpdump on enc0 doesn't show any ingress traffic, only egress. The SYN gets passed, the SYN ACK blocked on enc0 as a state mismatch. Doesn't impact i386.
Updated by Ermal Luçi about 12 years ago
This should behave better on latest snapshots.
Updated by Ermal Luçi almost 12 years ago
A fix to require correct mask was submitted on master.
Updated by Ermal Luçi almost 12 years ago
By any chance you have net.inet.ipsec.filtertunnel set to something grater than 0?
Updated by Chris Buechler almost 12 years ago
on the one system of ours that was having this issue, it's better than it used to be (it used to be impossible to complete a TCP handshake), but it still drops TCP sessions like crazy. Somewhere around a month ago it got better. Currently on Feb 8 snap.
$ sysctl -a|grep filtertunnel net.inet.ipsec.filtertunnel: 0 net.inet6.ipsec6.filtertunnel: 0
Updated by Ermal Luçi over 11 years ago
Can you try if setting net.inet.ipsec.filtertunnel: 0 to 1 makes it work correctly?
Updated by Chris Buechler over 11 years ago
Setting net.inet.ipsec.filtertunnel=1 definitely seems to fix it. On a tunnel where I couldn't keep a TCP session going for more than a minute or two previously, after changing only that, I've had a RDP session up for over an hour and multiple SSH sessions up, with no problem at all.
Updated by Chris Buechler over 11 years ago
Well, it fixed one problem and broke things that used to work. Incoming IPsec traffic from other connections that were working fine previously are now getting blocked in on em0 (WAN, where the IPsec terminates) where they should be hitting the rules for in on enc0.
Updated by Chris Buechler over 11 years ago
After further evaluation, this appears to have been fixed sometime in the past month or two by something that wasn't tagged on this specific ticket. Putting to feedback for the time being, will close after giving it some more time.
Updated by