I can see the src nodes (and my own IP) in the pfs statistics, but I get several ones with my own IP to different web real server (behind the carp VIP) and I still get loadbalanced on the 3 www when the states are expired (before the 4 minutes defined). My max src nodes are under the 10000 limit - 2000 - so I think this is something else.
I will continue to read pf howtos etc
Any piece of advice would be appreciated,

Sorry but i got his (1.2 RC3)

There were error(s) loading the rules: /tmp/rules.debug:27: syntax errorpfctl: Syntax error in config file: pf rules not loaded - The line in question reads [27]: set src.track 240…

I can read that in the /tmp/rules.debug

set src.track 240

Sorry

Here is the correct synthax

$rules .= "set timeout src.track 240\n";

The filter reloads, I will try it

Thanks a lot.

There were error(s) loading the rules: /tmp/rules.debug:27: syntax errorpfctl: Syntax error in config file: pf rules not loaded - The line in question reads [27]: set src.track 240…

I can read that in the /tmp/rules.debug

set src.track 240

This is a overall system setting.   Setting this value will apply to all WAN's.

Simply change 30 to 300 in the patch before applying.

Last question, is there a risk of states overload (RAM ?) playing with a too high timeout ?

Simply change 30 to 300 in the patch before applying.

My load balancer looks like this :

rdr inet proto tcp from any to 63.67.43.109 port = http -> { 52.41.76.140, 52.41.76.141, 52.41.76.142 } port 80 round-robin sticky-address

I would like an ip source tracking during 300 seconds to be sure I don't lose any sessions (like baskets etc)

When this patch is applied, does this mean I just need to add an allowing rule to the 3 real server with the src track option to be sure the load balanced connection will stay during 300 seconds ? What if the web server matching a source IP is down ?

Regards,
YP

Eclipse Workspace Patch 1.0

#P pfSense_RELENG_1_2
Index: etc/inc/filter.inc

RCS file: /cvsroot/pfSense/etc/inc/filter.inc,v
retrieving revision 1.575.2.368.2.57
diff -u -r1.575.2.368.2.57 filter.inc
–- etc/inc/filter.inc 5 Oct 2007 21:52:01 -0000 1.575.2.368.2.57
+++ etc/inc/filter.inc 21 Dec 2007 20:51:56 -0000
@@ -178,6 +178,7 @@
/* User defined maximum states in Advanced menu. */
$rules .= "set limit states {$config['system']['maximumstates']}\n";
}

• $rules .= "set src.track 30\n";
  $rules .= "\n";

update_filter_reload_status("Setting up SCRUB information");

I suppose I need to add a src.track timeout on my rule.
Is there an easy way to do it without breaking anything in the web interface ?

Regards
–
YP