PfSense in XEN ; dropped packets with bad TCP Checksum
-
Hello,
I'm running PfSense 2.2 in a Xen environment. The Xenguest tools are installed.I'm facing a unwanted behavior from the firewall:
The packets coming from VM which are hosted on the same hypervisor as Xen have a bad TCP Checksum. By default all the VM have TCP Checksum offload enabled so the virtualized OS doesn't really verify this checksum and assumes it's correct. Everything works well in that way and some CPU cycles are saved. The issue appears when you try to route these packets containing a TCP segment with a bad checksums: theses packets are systematically being dropped… Which makes sense from the firewall point of view.
Is there a way to tell PfSense firewall to not check the TCP Checksum of the segment? (Of course TCP Checksum offloading is disabled in the advanced network settings.)
Here is my setup:
3 machines on the same hypervisor:
A(HTTP Server) - PfSense - B (Client)
The SYN and SYN-ACK betwwen C and A are OK.
The issue start with the ACK segement from A -> CIf I disable the TX TCP Checksum Offload on A, everything is smooth. This is the real solution to my problem. However this also means I have to disable TCP TX Checksum Offload for all the VM...
-
The only workaround I know of is to disable checksum offloading. Last I heard, it was a known issue on Xen.
