Nat reflection issues (timeout) in both 1.2-RC2 and 1.2-RC3

[kionez]

Hi all, i just installed in production environment 1.2-RC2 version (built on Fri Aug 17 17:46:06 EDT 2007)..
i have 4 network interfaces: LAN, WAN, DMZ (opt1) and WAN2 (opt2)..

i setup all port-foward, nat and rules correctly, from an external connection i can reach all of my services in DMZ..

but i have some strange problems, if i try a LAN->WAN or LAN->WAN2(opt2) connection, such as SSH, RDP,  it fails after few seconds with timeout, but if i try LAN->DMZ connection it works without issues.

I read many post about issues concerning Nat and reflections, port forward and so on.. one solution seems to upgrade to 1.2-RC3.. (where i can download it?) is this release quite stable? i have to put it on production… does it solve my nat-reflection problems? are there any solutions to get my firewall working?

thanks in advance

k.

[kionez]

Hi.. i just updated my pfsense installation to 1.2-rc3 (built on Wed Nov 7 19:10:57 EST 2007)..
but the issue isn't resolved…

for example, if i try to telnet from a LAN workstation :

telnet my.public.address 25

after a while it hangs up with "Connection closed by foreign host."...
this happens even with ssh, rdp, pop3.. any kind of connection..

but if i try with:

telnet my.dmz.address 25

it works.

what can i do?

[kionez]

I'm here again.. ;)

i do a little "debug" session to understand how reflection works..
there is a inet.conf (located in /var/etc/) that spawn a simple "nc" between source and target ip…
well, i think that the script who creates this file is buggy\broken, because it writes somethink like:
"19056  stream  tcp    nowait/0        nobody  /usr/bin/nc nc -w 20 192.168.100.32 22"
i read the manpage of nc, and i found that "-w 20" is the "timeout for connects and final net reads"...
so i made a simple test:

$ date ; ssh my.public.address ; date
Thu Nov  8 15:09:43 CET 2007

----<ssh stuff="">----
Connection to my.public.address closed.

Thu Nov  8 15:10:03 CET 2007

..well, it's just 20 seconds...

maybe is this the way to solve this issue?</ssh>

[kionez]

..i hope is the last one…

i try to check /etc/inc/filter.inc file, on line  1172 i found the right
            $reflectiontimeout = "2000";
but on line 1231, the value come back to:
            $reflectiontimeout = "20";

is it correct?

the first affects to "tcp\udp" connection, the second is for "tcp" or "udp" only, so for these last ones the timeout is 20secs and not 2000secs as default.

k.

[firbc]

Try this:

http://forum.pfsense.org/index.php/topic,1528.0.html