Re: Slow NAT firewall

2003-09-16 Thread Lay Tay 




Hello,

Thanks.  You're right, Raphael replied and was right-on.  My sshd was doing
reverse DNS lookup and my firewall was preventing that.  I used the "-u0"
option in the sshd startup and the problem went away.


Regards,

Lay Boon.



   
 Chuck Swiger  
 <[EMAIL PROTECTED]> 
 Sent by:   To 
 owner-freebsd-que Lay Tay <[EMAIL PROTECTED]> 
 [EMAIL PROTECTED]  cc 
 g [EMAIL PROTECTED]   
   Subject 
           Re: Slow NAT firewall   
 09/16/2003 09:47  
 AM
   
   
   
   




Lay Tay wrote:
[ ... ]
> Everything worked fine except that I noticed ssh connection takes a very
> long time.  When I use PUTTY or WinSCP on a windows machine to connect to
> my internal machine, the authentication takes a very long time.  WinSCP
> will alway timeout on the first try, when  I hit "retry", the
> authentication goes through.
>
> This does not happen if I insert a "pass everything" rule in ipfw.

Sounds a lot like a DNS timeout.  I'm not sure your rules for port 53 are
doing
exactly the right thing; where does DNS traffic go when you do this SSH
connection?

--
-Chuck


___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to
"[EMAIL PROTECTED]"


___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Re: Slow NAT firewall

2003-09-16 Thread Chuck Swiger 
Lay Tay wrote:
[ ... ]
Everything worked fine except that I noticed ssh connection takes a very
long time.  When I use PUTTY or WinSCP on a windows machine to connect to
my internal machine, the authentication takes a very long time.  WinSCP
will alway timeout on the first try, when  I hit "retry", the
authentication goes through.
This does not happen if I insert a "pass everything" rule in ipfw.
Sounds a lot like a DNS timeout.  I'm not sure your rules for port 53 are doing 
exactly the right thing; where does DNS traffic go when you do this SSH connection?

--
-Chuck
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"