Re: insight on S10 ipfilter patch 125014-02?

On Tue, 6 Mar 2007, Carson Gaspar wrote:

> Date: Tue, 06 Mar 2007 08:54:39 -0800
> From: Carson Gaspar <carson@taltos.org>
> To: Jeff A. Earickson <jaearick@colby.edu>
> Cc: ipfilter@coombs.anu.edu.au
> Subject: Re: insight on S10 ipfilter patch 125014-02?
>
> Jeff A. Earickson wrote:
>> Darren,
>>
>> If I change my port 25 rule from:
>>
>> pass in quick proto tcp from any to 137.146.28.72 port = 25 flags S keep
>> state keep frags
>> pass out quick proto tcp from 137.146.28.72 to any port = 25 flags S keep
>> state keep frags
>>
>> to:
>>
>> pass in quick proto tcp from any to 137.146.28.72 port = 25
>> pass out quick proto tcp from 137.146.28.72 to any port = 25
>>
>> Then all/most of my email traffic halts. I am using Sun multipathing,
>
> If you want stateless rules, then you need to allow reply packets, which you
> haven't done. Try the following (syntax from memory, so...):
>
> pass out quick proto tcp from 137.146.28.72 to any port = 25
> pass in quick proto tcp from any port = 25 to 137.146.28.72 port > 32767
> flags A/A
> pass in quick proto tcp from any to 137.146.28.72 port = 25
> pass out quick proto tcp from 137.146.28.72 port = 25 to any port > 1023
> flags A/A
>
> You'll note that the inbound rule is more restrictive with ports. You've
> said you're running Solaris, so the anonymous port range is 32768-65535
> (unless you've changed it). The Internet has a much broader range of
> anonymous ports (but always >= 1024, in my experience). Personally, I'd get
> rid of the outbound ACK rule port restriction entirely, unless you have
> naughty users running things on your mail server...
>
> --
> Carson

Carson,

Thank you, thank you. Your rules worked as-is and my delayed email started
moving. I had been using my stateful rules for a long time with one wire
just fine. With the addition of a second wire and IP-multipathing in an
active-passive failover mode, the wheels fell off. I ran snoop on both
interfaces and I could see a split of traffic between the wires, so the
second wire wasn't as silent as I would have expected. I figured that it
might have something to do with that, or kernel patch 118833-36, or mpathd
changes, or the ipfilter patch, or God know what.

So how come mpathd and keep state don't play together? Is this a known
issue?

Jeff Earickson
Colby College