Re: Need Help badly - PF related

2008-09-23 Thread John Jackson
Comments are inline. On Sun, Sep 21, 2008 at 10:00:58PM -0700, Parvinder Bhasin wrote: I have users that can access the website fine (75.44.229.18) and some user that complain they can't access it. I don't know what gives. I have asked on the list for help but haven't still resolved

Re: Need Help badly - PF related

2008-09-23 Thread Parvinder Bhasin
I have done this already for the sake of troubleshooting. I have tried removing BLOCKs , I have tried removing anti-spoof , I have tried re-writing the redirector by putting pass but for some reason PF doesn't seem to like packets coming from some DSL links. I have also tried various

Re: Need Help badly - PF related

2008-09-23 Thread Parvinder Bhasin
Thanks a lot guys, I seem to have resolved the problem. So in short it seems like the netopia 30xx series router was doing some funky thing with packets which PF was rightfully rejecting (as they were not normalized). This is just my theory. Once I converted my openbsd box to the router

Re: Need Help badly - PF related

2008-09-22 Thread Stuart Henderson
On 2008-09-22, Parvinder Bhasin [EMAIL PROTECTED] wrote: I have users that can access the website fine (75.44.229.18) and some user that complain they can't access it. Include the dmesg so we can see what OS version you're running. Set pfctl -x misc and watch /var/log/messages, include any

Re: Need Help badly - PF related

2008-09-22 Thread Jason Dixon
On Sun, Sep 21, 2008 at 10:00:58PM -0700, Parvinder Bhasin wrote: I have users that can access the website fine (75.44.229.18) and some user that complain they can't access it. I don't know what gives. I have asked on the list for help but haven't still resolved this. I would really

Re: Need Help badly - PF related

2008-09-22 Thread Parvinder Bhasin
On Sep 22, 2008, at 1:14 AM, Stuart Henderson wrote: On 2008-09-22, Parvinder Bhasin [EMAIL PROTECTED] wrote: I have users that can access the website fine (75.44.229.18) and some user that complain they can't access it. Include the dmesg so we can see what OS version you're running. Set

Re: Need Help badly - PF related

2008-09-22 Thread Jason Dixon
On Mon, Sep 22, 2008 at 02:25:01AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 1:14 AM, Stuart Henderson wrote: On 2008-09-22, Parvinder Bhasin [EMAIL PROTECTED] wrote: I have users that can access the website fine (75.44.229.18) and some user that complain they can't access it.

Re: Need Help badly - PF related

2008-09-22 Thread Parvinder Bhasin
On Sep 22, 2008, at 4:46 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 02:25:01AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 1:14 AM, Stuart Henderson wrote: On 2008-09-22, Parvinder Bhasin [EMAIL PROTECTED] wrote: I have users that can access the website fine (75.44.229.18) and

Re: Need Help badly - PF related

2008-09-22 Thread Jason Dixon
On Mon, Sep 22, 2008 at 05:23:31AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 4:46 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 02:25:01AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 1:14 AM, Stuart Henderson wrote: On 2008-09-22, Parvinder Bhasin [EMAIL PROTECTED] wrote:

Re: Need Help badly - PF related

2008-09-22 Thread Parvinder Bhasin
On Sep 22, 2008, at 6:10 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 05:23:31AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 4:46 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 02:25:01AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 1:14 AM, Stuart Henderson wrote: On

Re: Need Help badly - PF related

2008-09-22 Thread Jason Dixon
On Mon, Sep 22, 2008 at 07:20:50AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 6:10 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 05:23:31AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 4:46 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 02:25:01AM -0700, Parvinder Bhasin

Re: Need Help badly - PF related

2008-09-22 Thread Parvinder Bhasin
On Sep 22, 2008, at 7:30 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 07:20:50AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 6:10 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 05:23:31AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 4:46 AM, Jason Dixon wrote: On Mon, Sep

Re: Need Help badly - PF related

2008-09-22 Thread Jason Dixon
On Mon, Sep 22, 2008 at 11:16:53AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 7:30 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 07:20:50AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 6:10 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 05:23:31AM -0700, Parvinder Bhasin

Re: Need Help badly - PF related

2008-09-22 Thread Parvinder Bhasin
On Sep 22, 2008, at 11:40 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 11:16:53AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 7:30 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 07:20:50AM -0700, Parvinder Bhasin wrote: On Sep 22, 2008, at 6:10 AM, Jason Dixon wrote: On Mon, Sep

Re: Need Help badly - PF related

2008-09-22 Thread Parvinder Bhasin
Any word Jason/Stuart? I am stuck at this. I have had sniffers all over the pace to see what was wrong that PF was NOT liking this connection but Nothing turned up. -Parvinder Bhasin On Sep 22, 2008, at 11:40 AM, Jason Dixon wrote: On Mon, Sep 22, 2008 at 11:16:53AM -0700, Parvinder

Re: Need Help badly - PF related

2008-09-22 Thread Parvinder Bhasin
Here is some more info: The request gets to the web server but when webserver is responding back to the client's request, PF BLOCKS the request: Here is tcpdump view from webserver: 20:44:47.539217 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 6, length: 48) 172.16.10.11.80

Need Help badly - PF related

2008-09-21 Thread Parvinder Bhasin
I have users that can access the website fine (75.44.229.18) and some user that complain they can't access it. I don't know what gives. I have asked on the list for help but haven't still resolved this. I would really appreciate any help. Why is the user in the below pflog getting