On Thursday 09 August 2007 11:25, Bram Schoenmakers wrote:
> Dear list,
>
> There is a problem with performing a dump from our webserver at the data
> centre to a backup machine at the office. Everytime we try to perform a
> dump, the SSH tunnel dies:
>
> # /sbin/dump -0uan -L -h 0 -f - / | /usr/bin/bzip2 | /usr/bin/ssh
> [EMAIL PROTECTED] \
>         dd of=/backup/webserver/root.0.bz2
>
>   DUMP: Date of this level 0 dump: Wed Aug  8 20:58:51 2007
>   DUMP: Date of last level 0 dump: the epoch
>   DUMP: Dumping snapshot of /dev/da0s1a (/) to standard output
>   DUMP: mapping (Pass I) [regular files]
>   DUMP: mapping (Pass II) [directories]
>   DUMP: estimated 60746 tape blocks.
>   DUMP: dumping (Pass III) [directories]
>   DUMP: dumping (Pass IV) [regular files]
> Read from remote host office.example.com: Operation timed out
>   DUMP: Broken pipe
>   DUMP: The ENTIRE dump is aborted.
>
> Here are some facts about the situation:
>
> * The client (where the dup takes place) runs FreeBSD 6.2-RELEASE-p4
> * The server (at the office) runs FreeBSD 6.1-RELEASE
> * Both hosts have ipf installed
> * Some IPF rules from the client:
>
>       pass out quick on bge0 proto tcp from any to any flags S keep state
>       pass out quick on bge0 proto udp from any to any keep state
>       pass out quick on bge0 proto icmp from any to any keep state
>       pass out quick on bge0 proto gre from any to any keep state
>       pass out quick on bge0 proto esp from any to any keep state
>       pass out quick on bge0 proto ah from any to any keep state
>
>       block out quick on bge0 all
>       pass in quick on bge0 proto tcp from any to any port = 22 flags S keep
> state
>
>       block return-rst in log quick on bge0 proto tcp from any to any
>       block in quick on bge0 proto tcp all flags S
>       block return-icmp-as-dest(port-unr) in log quick on bge0 proto udp from
> any to any
>       block in log quick on bge0 all
>
> * Some IPF rules from the server:
>
>       pass out quick on re0 proto tcp from any to any flags S keep state
>       pass out quick on re0 proto udp from any to any keep state
>       pass out quick on re0 proto icmp from any to any keep state
>       pass out quick on re0 proto gre from any to any keep state
>       pass out quick on re0 proto esp from any to any keep state
>       pass out quick on re0 proto ah from any to any keep state
>
>       pass out quick on re0 proto tcp from any to any port = 22 keep state
>
>       pass in quick on re0 proto tcp from any to any port = 22 flags S keep
> state
>
>       block return-rst in quick on re0 proto tcp all flags S
>       block in quick on re0 proto tcp all flags S
>       block return-icmp-as-dest(port-unr) in log quick on re0 proto udp from
> any to any
>       block in log quick on re0 all
>

These rules deny incoming ICMP in general, Path MTU discovery will
be broken.

[snip]
> * Maybe the MTU value was the cause, but setting them to 1472 on both
> sides didn't improve the situation as well.

Try using a much lower MTU, something like 1400 or perhaps lower,
just for testing. You should configure this, on both client and server.

I'm not familiar with ipf to give the exact rule, but I would allow
ALL ICMP traffic, at least for testing purposes. I think this is
correct:
pass out quick proto icmp from any to any
pass in quick proto icmp from any to any

somewhere above the "block in log quick on re0 all" rule.

Hope this helps a bit

Nikos



_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to