High Load Average and Kernel Panics
-
First, I would like to thank the pfSense team for the wonderful work they have done with it over the past couple years. I have been using pfSense for close to 6 months now and have been very satisfied with it overall. I have been using for 3 or 4 months a 7.2 build (don't recall the exact date now, but I have it saved) without incident. Several weeks ago I upgraded to the new 8.1 builds and have been having stability issues. After around a day of operation, the following message is displayed by the kernel:
Approaching the limit on PV entries, consider increasing either the vm.pmap.shpgperproc or the vm.pmap.pv_entry_max sysctl.Several hours later it crashes with this message:
panic: get_pv_entry: incrase vm.pmap.shpgperproc cpuid = 0 KDB: stack backtrade: X_dv_sym_numargs(c0e2f748,ecc5ba24,c0997569,c0e5e6b9,0,...) at X_dv_sym_numargs+0x146 xdb_backtrace(c0e5e6b9,0,c0e5f0d7,ecc5ba30,0,...) at kdb_backtrace+0x29 panic(c0e5f0d7,10,c0df0a66,0,a0,...) at panic+0x119 pmap_remove_pages(0,3096000,ecc5bae8,c0d516fe,c1a79a38,...) at pmap_remove_pages+0x72f pmap_remove_pages(c1a79a38,c1a797f8,c0c7118c,c9268958,0,...) at pmap_remove_pages+0xb3b pmap_enter(c92689c0,28111000,1,c1a789e5,...) at pmap_enter+0x22e vm_fault(c9268910,28111000,1,0,0,...) at vm_fault+0x1b65 dblfault_handler() at dblfault_handler+0x53b --- trap 0x17, eip = 0, esp = 0, ebp = 0 --- KDB: enter: panic [thread] Stopped at kdb_enter+0x3a: mov1 $0,kdb_why db> Based on its own suggestion and what I have found on the internet, I tried setting the following kernal parameters, but to no avail: [code]kern.ipc.shm_use_phys=1 #default 0 vp.pmap.shpgperproc=400 #default 200 vm.pmap.pv_entry_max=2000000 #default 1485792 [/code] The second issue I am having is with system resources. The machine is a 2.4GHz P4 (no hyperthreading) with 1GB of RAM and it serves a 35/35 Mbps connection. Note that bittorrent is in use on this connect, so there are always a high number of connections in use. After as little as 15 minutes of operation, pfSense reports load averages in the dozens to hundreds. The curious aspect as that pfSense does not slow down: the internet connection and the webConfigurator are perfectly usable. In addition, CPU usage hovers between 15 and 30%, spiking up to 70 and 80% for a second or so, and memory usage remains below 50% (swap usage is 0%). The NIC is the machine is an Intel 82558 Pro/100 (dual-link, fxp0 and fxp1), however I have also done tests with a 3com NIC (xl0) and an SMC NIC (rl0). I have tried different firewall optimization settings, as well as enabling/disabling hardware checksum offloading and polling, to no effect. The load averages seem to grow (and the system seems to crash) faster with the Intel NIC. More specifically, the symptoms are as follows: Every several minutes, the system status page resembles this: [code]last pid: 13324; load averages: 187.27, 77.04, 55.40 up 0+02:58:35 00:24:40 3465 processes:3 running, 3446 sleeping, 16 waiting Mem: 341M Active, 33M Inact, 147M Wired, 144K Cache, 20M Buf, 466M Free Swap: 2048M Total, 2048M Free PID USERNAME PRI NICE SIZE RES STATE TIME WCPU COMMAND 11 root 171 ki31 0K 8K RUN 121:54 61.57% idle 12 root -68 - 0K 128K WAIT 3:56 0.68% {irq22: fxp0 acpi0} 14891 root 76 0 114M 10380K accept 0:20 0.39% php 40544 root 76 0 115M 10256K piperd 0:09 0.39% php 55281 root 52 0 3424K 1564K so_rcv 0:00 0.39% inetd 55084 root 51 0 3424K 1564K so_rcv 0:00 0.39% inetd 54731 root 51 0 3424K 1564K so_rcv 0:00 0.39% inetd 55030 root 51 0 3424K 1564K so_rcv 0:00 0.39% inetd 12 root -68 - 0K 128K WAIT 3:10 0.29% {irq21: fxp10} 22999 root 48 0 3424K 1380K select 1:27 0.29% inetd 25127 root 76 0 114M 10380K accept 0:19 0.29% php 54259 root 51 0 3424K 1564K so_rcv 0:00 0.29% inetd 54277 root 51 0 3424K 1564K so_rcv 0:00 0.29% inetd 53883 root 51 0 3424K 1564K so_rcv 0:00 0.29% inetd 53652 root 50 0 3424K 1564K so_rcv 0:00 0.29% inetd 54443 root 51 0 3424K 1564K so_rcv 0:00 0.29% inetd 54148 root 50 0 3424K 1564K so_rcv 0:00 0.29% inetd 54677 root 51 0 3424K 1564K so_rcv 0:00 0.29% inetd pid: 11557; load averages: 32.76, 12.53, 5.43 up 0+00:06:08 02:02:14 534 processes: 2 running, 516 sleeping, 16 waiting Mem: 136M Active, 13M Inact, 53M Wired, 124K Cache, 18M Buf, 785M Free Swap: 2048M Total, 2048M Free --------------------------------------------------------------------------------------------------------- last pid: 52184; load averages: 12.03, 10.25, 5.06 up 0+00:07:14 02:03:20 1045 processes:2 running, 1027 sleeping, 16 waiting Mem: 140M Active, 17M Inact, 76M Wired, 120K Cache, 18M Buf, 755M Free Swap: 2048M Total, 2048M Free PID USERNAME PRI NICE SIZE RES STATE TIME WCPU COMMAND 11 root 171 ki31 0K 8K RUN 3:33 62.99% idle 38437 root 76 0 115M 16916K piperd 0:02 0.20% php 39092 root 76 0 114M 13412K accept 0:02 0.20% php 31623 nobody 76 0 3332K 1000K select 0:00 0.20% nc 31754 nobody 73 0 3332K 1000K select 0:00 0.20% nc 29962 nobody 72 0 3332K 1000K select 0:00 0.20% nc 29640 nobody 72 0 3332K 1000K select 0:00 0.20% nc 30612 nobody 76 0 3332K 1000K select 0:00 0.20% nc 29807 nobody 73 0 3332K 1000K select 0:00 0.20% nc 30452 nobody 72 0 3332K 1000K select 0:00 0.20% nc 32178 root 76 0 3424K 1780K so_rcv 0:00 0.20% inetd 32071 root 76 0 3424K 1780K so_rcv 0:00 0.20% inetd 12 root -68 - 0K 128K WAIT 0:02 0.10% {irq22: fxp1 acpi} 12 root -68 - 0K 128K WAIT 0:01 0.10% {irq21: fxp0} 29370 nobody 72 0 3332K 1000K select 0:00 0.10% nc 30228 nobody 76 0 3332K 1000K select 0:00 0.10% nc 26411 nobody 69 0 3332K 1000K select 0:00 0.10% nc 27303 nobody 72 0 3332K 1000K select 0:00 0.10% nc[/code] What is calling all those instances of inetd and netcat, I have no idea. Each time they are called, the load average significantly rises but, again, there is no perceived performance degradation. The number inetd processes appears to build up gradually, resulting in several thousand instances of it and, I suspect, contributing to the kernel panic mentioned above. This reminds me of an issue in the 7.2 builds from last spring where states in a PPPoE WAN connection would not be torn down and would just accumulate, inevitablly hitting the hard cap and crashing the system. That issues was fixed last spring, but at first glance, they seem somewhat similar. Relevant system status information included below. Networking portions (states, firewall rules, etc.), but can, along with any other information, be provided if requested. If it is at all relevant, I seem to be experiencing constant UDP floods on various (random?) high numbered ports (40000+). I suspect they are related to bittorrent, but I do not know exactly what is causing them. Any help would be greatly appreciated, as it is unacceptable having to physically reboot the machine every day or two. If this cannot be resolved, my only recourse will be to downgrade to that build of 7.2\. Hopefully the 8.1 config will work on 7.2... Intel NIC info: [code]System uptime 2:47AM up 51 mins, 1 user, load averages: 105.02, 58.41, 50.01 Interfaces fxp0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500 options=8 <vlan_mtu>ether 00:90:27:e8:74:a8 inet6 fe80::290:27ff:fee8:74a8%fxp0 prefixlen 64 scopeid 0x1 inet 98.116.115.115 netmask 0xffffff00 broadcast 98.116.115.255 nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (100baseTX <full-duplex>) status: active fxp1: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500 options=8 <vlan_mtu>ether 00:90:27:e8:74:a9 inet 192.168.2.1 netmask 0xffffff00 broadcast 192.168.2.255 inet6 fe80::290:27ff:fee8:74a9%fxp1 prefixlen 64 scopeid 0x2 nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (100baseTX <full-duplex>) status: active ath0: flags=8802 <broadcast,simplex,multicast>metric 0 mtu 2290 ether 00:11:95:c3:27:b5 media: IEEE 802.11 Wireless Ethernet autoselect (autoselect) status: no carrier pflog0: flags=100 <promisc>metric 0 mtu 33200 enc0: flags=0<> metric 0 mtu 1536 lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384 options=3 <rxcsum,txcsum>inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6 inet 127.0.0.1 netmask 0xff000000 nd6 options=3 <performnud,accept_rtadv>pfsync0: flags=0<> metric 0 mtu 1460 syncpeer: 224.0.0.240 maxupd: 128 bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500 ether be:c9:1e:f8:26:e1 id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15 maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200 root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0 member: fxp1 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 2 priority 128 path cost 200000 ovpns1: flags=8051 <up,pointopoint,running,multicast>metric 0 mtu 1500 inet6 fe80::290:27ff:fee8:74a8%ovpns1 prefixlen 64 scopeid 0x9 inet 192.168.3.1 --> 192.168.3.2 netmask 0xffffffff nd6 options=3 <performnud,accept_rtadv>Opened by PID 29860 PF Info Status: Enabled for 0 days 00:50:38 Debug: Urgent Interface Stats for fxp1 IPv4 IPv6 Bytes In 252227065 278016 Bytes Out 33900989 152 Packets In Passed 599283 0 Blocked 4051 3432 Packets Out Passed 288971 2 Blocked 0 0 State Table Total Rate current entries 7078 searches 1842498 606.5/s inserts 60670 20.0/s removals 53592 17.6/s Counters match 166532 54.8/s bad-offset 0 0.0/s fragment 0 0.0/s short 0 0.0/s normalize 0 0.0/s memory 0 0.0/s bad-timestamp 0 0.0/s congestion 0 0.0/s ip-option 1329 0.4/s proto-cksum 189 0.1/s state-mismatch 85 0.0/s state-insert 85 0.0/s state-limit 0 0.0/s src-limit 0 0.0/s synproxy 0 0.0/s divert 0 0.0/s top | head -n5 last pid: 7720; load averages: 105.02, 58.41, 50.01 up 0+00:51:22 02:47:28 3403 processes:2 running, 3401 sleeping Mem: 328M Active, 26M Inact, 145M Wired, 120K Cache, 18M Buf, 488M Free Swap: 2048M Total, 2048M Free sysctl hw.physmem hw.physmem: 1055334400 ipfw show ipfw: getsockopt(IP_FW_GET): Protocol not available INFO: Status: Enabled for 0 days 00:50:41 Debug: Urgent Interface Stats for fxp1 IPv4 IPv6 Bytes In 252690521 278448 Bytes Out 34757885 152 Packets In Passed 601840 0 Blocked 4054 3438 Packets Out Passed 291080 2 Blocked 0 0 State Table Total Rate current entries 6982 searches 1848581 607.9/s inserts 60744 20.0/s removals 53762 17.7/s Counters match 166747 54.8/s bad-offset 0 0.0/s fragment 0 0.0/s short 0 0.0/s normalize 0 0.0/s memory 0 0.0/s bad-timestamp 0 0.0/s congestion 0 0.0/s ip-option 1329 0.4/s proto-cksum 189 0.1/s state-mismatch 85 0.0/s state-insert 85 0.0/s state-limit 0 0.0/s src-limit 0 0.0/s synproxy 0 0.0/s divert 0 0.0/s TIMEOUTS: tcp.first 3600s tcp.opening 900s tcp.established 432000s tcp.closing 3600s tcp.finwait 600s tcp.closed 180s tcp.tsdiff 60s udp.first 300s udp.single 150s udp.multiple 900s icmp.first 20s icmp.error 10s other.first 60s other.single 30s other.multiple 60s frag 30s interval 10s adaptive.start 58800 states adaptive.end 117600 states src.track 0s LIMITS: states hard limit 98000 src-nodes hard limit 10000 frags hard limit 5000 tables hard limit 1000 table-entries hard limit 200000 netstat -s -ppfsync pfsync: 0 packets received (IPv4) 0 packets received (IPv6) 0 packets discarded for bad interface 0 packets discarded for bad ttl 0 packets shorter than header 0 packets discarded for bad version 0 packets discarded for bad HMAC 0 packets discarded for bad action 0 packets discarded for short packet 0 states discarded for bad values 0 stale states 0 failed state lookup/inserts 0 packets sent (IPv4) 0 packets sent (IPv6) 0 send failed due to mbuf memory error 0 send error Processes USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND root 33308 20.3 0.4 7544 3736 ?? S 1:56AM 0:05.73 /usr/local/sbin/lighttpd -f /var/etc/lighty-webConfigurator.conf root 39014 10.7 1.2 120112 12388 ?? S 1:56AM 0:13.01 /usr/local/bin/php root 12 4.1 0.0 0 128 ?? WL 1:56AM 0:56.47 [intr] root 33837 0.9 0.9 119088 9460 ?? S 1:56AM 0:00.17 /usr/local/bin/php root 20661 0.3 0.1 3424 1380 ?? Ss 1:56AM 0:29.41 /usr/sbin/inetd -wW -R 0 -a 127.0.0.1 /var/etc/inetd.conf root 44556 0.3 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 42939 0.2 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 43536 0.2 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 43542 0.2 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 43844 0.2 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 44142 0.2 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 44240 0.2 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 44431 0.2 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 36147 0.1 0.8 117040 7756 ?? S 1:56AM 0:00.05 /usr/local/bin/php root 36974 0.1 1.0 117040 9836 ?? S 1:56AM 0:00.53 /usr/local/bin/php root 42652 0.1 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 42711 0.1 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 43196 0.1 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 0 0.0 0.0 0 64 ?? DLs 1:56AM 0:00.21 [kernel] root 1 0.0 0.0 1888 196 ?? ILs 1:56AM 0:00.01 /sbin/init -- root 2 0.0 0.0 0 8 ?? DL 1:56AM 0:00.19 [g_event] root 3 0.0 0.0 0 8 ?? DL 1:56AM 0:00.24 [g_up] root 4 0.0 0.0 0 8 ?? DL 1:56AM 0:00.21 [g_down] root 5 0.0 0.0 0 8 ?? DL 1:56AM 0:00.00 [crypto] root 6 0.0 0.0 0 8 ?? DL 1:56AM 0:00.00 [crypto returns] root 7 0.0 0.0 0 8 ?? DL 1:56AM 0:00.00 [xpt_thrd] root 8 0.0 0.0 0 8 ?? DL 1:56AM 0:00.02 [fdc0] root 9 0.0 0.0 0 8 ?? DL 1:56AM 0:00.85 [pfpurge] root 10 0.0 0.0 0 8 ?? DL 1:56AM 0:00.00 [audit] root 11 0.0 0.0 0 8 ?? RL 1:56AM 35:31.51 [idle] root 13 0.0 0.0 0 8 ?? DL 1:56AM 0:00.00 [ng_queue] root 14 0.0 0.0 0 8 ?? DL 1:56AM 0:01.35 [yarrow] root 15 0.0 0.0 0 128 ?? DL 1:56AM 0:00.22 [usb] root 16 0.0 0.0 0 8 ?? DL 1:56AM 0:00.00 [pagedaemon] root 17 0.0 0.0 0 8 ?? DL 1:56AM 0:00.00 [vmdaemon] root 18 0.0 0.0 0 8 ?? DL 1:56AM 0:00.00 [pagezero] root 19 0.0 0.0 0 8 ?? DL 1:56AM 0:00.01 [idlepoll] root 20 0.0 0.0 0 8 ?? DL 1:56AM 0:00.02 [bufdaemon] root 21 0.0 0.0 0 8 ?? DL 1:56AM 0:00.14 [syncer] root 22 0.0 0.0 0 8 ?? DL 1:56AM 0:00.01 [vnlru] root 23 0.0 0.0 0 8 ?? DL 1:56AM 0:00.02 [softdepflush] root 24 0.0 0.0 0 8 ?? DL 1:56AM 0:00.00 [flowcleaner] root 30 0.0 0.0 0 8 ?? DL 1:56AM 0:00.06 [md0] root 101 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 128 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 138 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 139 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 160 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 171 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 174 0.0 0.0 1888 16 ?? Is 1:56AM 0:00.00 /sbin/devd root 188 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 192 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 232 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 289 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 294 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 336 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 405 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 413 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 418 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 455 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 471 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 494 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 499 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 502 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 508 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 527 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 544 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 599 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 605 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 614 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 618 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 619 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 634 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 649 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 650 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 653 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 714 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 742 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 761 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 763 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 772 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 796 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 821 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 883 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 898 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 899 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 904 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 910 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 927 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 933 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 950 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 961 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 974 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 978 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1008 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 1047 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 1064 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1069 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 1075 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1111 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 1112 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1116 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1247 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 1254 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1332 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1351 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 1352 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1361 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 1362 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 1401 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1409 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 1433 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 1448 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1456 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 1479 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1480 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1486 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 1487 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1549 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1588 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 1655 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1663 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 1669 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1675 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1690 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 1696 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1706 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1716 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1728 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 1729 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 1733 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1735 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1736 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1760 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1762 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1767 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1830 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 1881 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 1882 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 1895 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 1947 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2004 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2013 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2020 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 2055 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2059 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2078 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2081 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2110 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 2140 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2142 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2196 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2199 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 2202 0.0 0.2 3424 1564 ?? S 2:47AM 0:00.00 inetd: wrapping (inetd) root 2226 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2232 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2242 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 2253 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 2277 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2318 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2336 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2354 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2412 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2430 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2446 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2448 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 2449 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2462 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2500 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 2514 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 2528 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2545 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 2570 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 2571 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 2585 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2631 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2647 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2694 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2695 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 2715 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 2716 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 2772 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2773 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2839 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2867 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2883 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 2887 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2892 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2905 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2909 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2919 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 2923 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2943 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 2962 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 2979 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3023 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3029 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3044 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3055 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 3085 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 3095 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3113 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3169 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3177 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3206 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 3213 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3219 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3260 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3300 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3326 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3376 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3386 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3389 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3396 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 3403 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 3411 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 3470 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3474 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3520 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 3534 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3554 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3556 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3560 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3585 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 3623 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 3634 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3674 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 3680 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 3687 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3690 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3714 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 3719 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3743 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 3776 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3783 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3808 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3816 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 3845 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 3853 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3854 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3863 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3871 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3881 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3918 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 3919 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3927 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 3940 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 3976 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 3984 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 3988 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 4005 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4015 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4041 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4047 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4063 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 4103 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 4124 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4129 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4135 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 4159 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4186 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4190 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 4201 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 4208 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 4210 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4296 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 4307 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4345 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4374 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4393 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4395 0.0 0.0 3424 220 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4424 0.0 0.0 3424 152 ?? S 2:34AM 0:00.00 inetd: wrapping (inetd) root 4427 0.0 0.0 3424 220 ?? S 2:02AM 0:00.00 inetd: wrapping (inetd) root 4468 0.0 0.0 3424 220 ?? S 2:05AM 0:00.00 inetd: wrapping (inetd) root 4479 0.0 0.1 3424 1236 ?? I 2:34AM 0:00.00 inetd: wrapping (inetd) root 4503 0.0 0.0 3424 152 ?? S 2:34AM&nb[/code][/thread]</performnud,accept_rtadv></up,pointopoint,running,multicast></learning,discover,autoedge,autoptp></up,broadcast,running,simplex,multicast></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></promisc></broadcast,simplex,multicast></full-duplex></performnud,accept_rtadv></vlan_mtu></up,broadcast,running,promisc,simplex,multicast></full-duplex></performnud,accept_rtadv></vlan_mtu></up,broadcast,running,simplex,multicast> -
inetd and netcat are used for NAT reflection, you might try to disable NAT reflection and see if the problems persist.
-
That appears to have done it, thank you very much. Apologies for the long post, half of it got cut of, including the closing ```tags. -
Obviously something seriously wrong with reflection since the recent changes (though a number of things have been fixed, too). Everything you're seeing is caused by reflection, all those nc and inetd processes being spawned.
Please email me a backup of your configuration (cmb at pfsense dot org) and I'll take a look.
-
It even depends on how much reflection is used/abused.
-
Using 1.2.3-RELEASE here
I use bittorent and was experiencing over a 1000 inetd running :o and I had to reboot every few days :(.
I was using one Port forward NAT entry for TCP and another one for UDP
I have a Firewall rule for TCP and 1 for UDP on the WAN
the /tmp/rules.debug looked like# NAT Inbound Redirects rdr on ng0 proto tcp from any to 12.34.56.78 port { 1723 } -> 172.28.15.15 # Reflection redirects rdr on $lan proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19000 rdr on $DMZ proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19001 rdr on $WiFi proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19002 rdr on ng0 proto udp from any to 12.34.56.78 port { 1723 } -> 172.28.15.15 # Reflection redirects rdr on $lan proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19003 rdr on $DMZ proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19004 rdr on $WiFi proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19005 # NAT Reflection rules pass in quick on $lan inet proto tcp from any to $loopback port 19000 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $DMZ inet proto tcp from any to $loopback port 19001 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $WiFi inet proto tcp from any to $loopback port 19002 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $lan inet proto udp from any to $loopback port 19003 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $DMZ inet proto udp from any to $loopback port 19004 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $WiFi inet proto udp from any to $loopback port 19005 keep state label "NAT REFLECT: Allow traffic to localhost"today I changed for a single TCP/UDP Port forward NAT entry and rebooted
I still have a Firewall rule for TCP and 1 for UDP on the WAN
Now I have a steady 46 inetd running after 3 hour uptime ;o)# NAT Inbound Redirects rdr on ng0 proto { tcp udp } from any to 12.34.56.78 port { 1723 } -> 172.28.15.15 # Reflection redirects rdr on $lan proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19000 rdr on $lan proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19001 rdr on $DMZ proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19002 rdr on $DMZ proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19003 rdr on $WiFi proto tcp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19004 rdr on $WiFi proto udp from any to 12.34.56.78 port { 1723 } -> 127.0.0.1 port 19005 # NAT Reflection rules pass in quick on $lan inet proto tcp from any to $loopback port 19000 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $lan inet proto udp from any to $loopback port 19001 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $DMZ inet proto tcp from any to $loopback port 19002 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $DMZ inet proto udp from any to $loopback port 19003 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $WiFi inet proto tcp from any to $loopback port 19004 keep state label "NAT REFLECT: Allow traffic to localhost" pass in quick on $WiFi inet proto udp from any to $loopback port 19005 keep state label "NAT REFLECT: Allow traffic to localhost"$WiFi is disabled in both case
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.