Re: ACKs create separate state

--Apple-Mail=_50F87E90-862F-4B66-8EB7-53A2BF5E1072
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

It seems to be missing IPv6 route to the sender.
When I play with ping6 from the source to the target, after a while the =
pings go through.
=46rom that point, the pings in the opposite direction also go through =
and every works.

IPv6 comes to gw1 via the VPN.
When enc0 comes up, a IPv6 default route is set to localhost by =
ifstated:

state vpn_reachable {
	init {
		run "pkill -HUP syslogd"
		run "/sbin/route add -inet6 default localhost"
		run "/sbin/sysctl -w net.inet6.ip6.forwarding=3D1"
		run "/usr/sbin/rad"
		run "sleep 5"
		run "date | mail -s 'Firewall State Change: =
vpn_reachable' root"
	}
	if ($carp_unknown)
		run "sleep 5"
	if ($carp_down)
		set-state auto
	if (! $vpn_up)
		set-state vpn_failed
}

Please advice improvements!

Thanks, Axel

> Am 10.12.2019 um 11:13 schrieb Axel Rau <[email protected]>:
>=20
>=20
>=20
>> Am 09.12.2019 um 22:07 schrieb Axel Rau <[email protected]>:
>>=20
>> There seems to be a separate state for ACKs:
>=20
> The origin of the problem seems to be at the other side of the link
> (abcd:2222:3333:4444::200,a FreeBSD 12.1 box).
> Everything is dual stack. When I block IPv6, everything works.
> Why does this happen with some clients with other not (all in the same =
subnets)?
> This is not application specific, but the above host is always the =
server.
>=20
> This points me at the OpenBSD firewall side.
> There is another firewall at the other end of the VPN.
>=20
> I have a flow extracted and I attach both the OpenBSD 6.6 side (gw1)
> and the FreeBSD side (db3) as text files.
>=20
> Clueless:
> Axel
> <gw1.32404>
> <db3.32404>
>=20
> ---
> PGP-Key: CDE74120  =E2=98=80  computing @ chaos claudius
>=20

---
PGP-Key: CDE74120  =E2=98=80  computing @ chaos claudius


--Apple-Mail=_50F87E90-862F-4B66-8EB7-53A2BF5E1072
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.2
Comment: GPGTools - http://gpgtools.org

iQIzBAEBCAAdFiEEl5evOTfnjZdhkBzKaPxTRM3nQSAFAl3v6ncACgkQaPxTRM3n
QSBE5w/+LPltkX6+vHmIZu0ciFYmH4ePhItZf+Zv9sZvXGdp0YhQ+wbjxGpPSIEl
ZUj0N7D+yxvyWTNHdcrqeapvZInWjtWPkMVc96B6rcPEKMtZJ19VRbTfJtfI/AXW
e4LWlkAJYXjK/DddJW0Yq4MfnO7B/jlSF611vhIOLLo7fEfVBIaDUfp6dtoy1OAn
CMiFDFlh73OxdAg3aEmAfjLej9oKNWd4D0RXxpvedFgilKcTFyatq70lRaMgKRGw
4qIMrQmIwStsc5eOgDlxPnitCo/UIzYWwTKaYiN/4JIQ7lVOUNgFZAY8sQN8cMZz
mYNmWZhBU1t0tW7D4Ma6PyEbR0tLSDABjLP8J3254cYEYdtKnFHUgam859Re2afI
p9A3/FnHng94FE+S2F8oPUMK7waWXc6gAMqWHXJvo6EsmH4Cm15ljJh/OZxYNe0d
bRbOuev4CIvxUTKb9al+LEPw6ID6dmHEXYdi6N5YnHZZIYhZgIhrhWzEfgTGM6bR
GhA/5gUNgqLRRpzf6sREpVI0/td8yo4qmuTMzy9BLe6qrViy71cRqPXg+pJAK7GC
iMLSOaNAbTLKjax9aOz2X1d8SZMAdoTRSDeRuQKyXzi9Arft2uWxSggAHwB3nKEK
vVLx4V0sZo4g7oLCFC24bP7IBm6d0kKcksoAKJGNgFDSYG+RkjY=
=6+xG
-----END PGP SIGNATURE-----

--Apple-Mail=_50F87E90-862F-4B66-8EB7-53A2BF5E1072--