headers
Aarno Aukia | 1 Mar 2010 08:38
Picon

1.2.3: dnsmasq and mac os x 10.6 snow leopard

Hello,

I just found out my new mac os x 10.6 snow leopard machine seems to
have problems with DNS TTL 0, dnsmasqs default TTL for local entries
(http://www.mac-forums.com/forums/os-x-operating-system/164649-snow-leopard-keeps-dropping-dns.html#post912124).
Adding " --local-ttl 1" to the dnsmasq $args in /etc/inc/services.inc
(around line 634 on this 1.2.3-rc3 nanobsd) seems to work out the
issues, although I'll keep testing it for some more time...

-Aarno
--

-- 
Aarno Aukia
Atrila GmbH
Switzerland

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@...
For additional commands, e-mail: support-help@...

Commercial support available - https://portal.pfsense.org
Permalink | Reply | 5 comments |
headers
Hiren Joshi | 1 Mar 2010 11:24
Favicon

RE: Slow TCP connection

I'm not hitting the max states (this is set to a high enough number) and
a tcp dump is impractical as this is not a consistent failure.

> -----Original Message-----
> From: Evgeny Yurchenko [mailto:evg.yurch@...] 
> Sent: 26 February 2010 14:44
> To: support@...
> Subject: Re: [pfSense Support] Slow TCP connection
> 
> Hiren Joshi wrote:
> > Hi,
> >
> > I'm running a load of performance tests and I've found that 
> one in every
> > 100 odd TCP connections takes a few seconds to make the 
> initial call.
> > Once the connection has been established things go quickly but the
> > initial connection sometimes hangs for a second or two.
> >
> > Can someone point me in the right direction as to what sort 
> of debugging
> > I can run or what logs to look at for this?
> >
> > Thanks,
> > Josh.
> > pfsense 1.2-RELEASE.
> >   
> Aren't you running into maximum number of states/
> Do you get tcpdump for this slow TCP connection initiation?
> Evgeny.
(Continue reading)

Permalink | Reply | 13 comments |
headers
Scott Ullrich | 1 Mar 2010 15:45
Picon
Gravatar

Re: 1.2.3: dnsmasq and mac os x 10.6 snow leopard

On Mon, Mar 1, 2010 at 2:38 AM, Aarno Aukia <aarnoaukia@...> wrote:
> Hello,
>
> I just found out my new mac os x 10.6 snow leopard machine seems to
> have problems with DNS TTL 0, dnsmasqs default TTL for local entries
> (http://www.mac-forums.com/forums/os-x-operating-system/164649-snow-leopard-keeps-dropping-dns.html#post912124).
> Adding " --local-ttl 1" to the dnsmasq $args in /etc/inc/services.inc
> (around line 634 on this 1.2.3-rc3 nanobsd) seems to work out the
> issues, although I'll keep testing it for some more time...

That does not make any sense to me.  I have quite a number of Macs and
do not see this issue.

Scott

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@...
For additional commands, e-mail: support-help@...

Commercial support available - https://portal.pfsense.org
Permalink | Reply | 4 comments |
headers
Vick Khera | 1 Mar 2010 22:01

Re: 1.2.3: dnsmasq and mac os x 10.6 snow leopard

On Mon, Mar 1, 2010 at 9:45 AM, Scott Ullrich <sullrich@...> wrote:
> That does not make any sense to me.  I have quite a number of Macs and
> do not see this issue.
>

Ditto.  My entire home network is Macs (5 of them) and I never have
seen any issues with the dns on pfsense.

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@...
For additional commands, e-mail: support-help@...

Commercial support available - https://portal.pfsense.org
Permalink | Reply | 1 comment |
headers
Mr. Kai Lan | 1 Mar 2010 22:07

Re: 1.2.3: dnsmasq and mac os x 10.6 snow leopard

Hi there, we have 3 mac, never have problem with pfsense, never seen the issue you mentioned. I think you
might have to carefully check everything in you network.

On 1 Mar 2010, at 21:01, Vick Khera wrote:

> On Mon, Mar 1, 2010 at 9:45 AM, Scott Ullrich <sullrich@...> wrote:
>> That does not make any sense to me.  I have quite a number of Macs and
>> do not see this issue.
>> 
> 
> Ditto.  My entire home network is Macs (5 of them) and I never have
> seen any issues with the dns on pfsense.
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: support-unsubscribe@...
> For additional commands, e-mail: support-help@...
> 
> Commercial support available - https://portal.pfsense.org
> 

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@...
For additional commands, e-mail: support-help@...

Commercial support available - https://portal.pfsense.org
Permalink | Reply | 0 comments |
headers
Chris Buechler | 2 Mar 2010 00:12
Picon

Re: 1.2.3: dnsmasq and mac os x 10.6 snow leopard

On Mon, Mar 1, 2010 at 9:45 AM, Scott Ullrich <sullrich@...> wrote:
> On Mon, Mar 1, 2010 at 2:38 AM, Aarno Aukia <aarnoaukia@...> wrote:
>> Hello,
>>
>> I just found out my new mac os x 10.6 snow leopard machine seems to
>> have problems with DNS TTL 0, dnsmasqs default TTL for local entries
>> (http://www.mac-forums.com/forums/os-x-operating-system/164649-snow-leopard-keeps-dropping-dns.html#post912124).
>> Adding " --local-ttl 1" to the dnsmasq $args in /etc/inc/services.inc
>> (around line 634 on this 1.2.3-rc3 nanobsd) seems to work out the
>> issues, although I'll keep testing it for some more time...
>
> That does not make any sense to me.  I have quite a number of Macs and
> do not see this issue.
>

It's only for local entries, and I bet you (and most others) don't
resolve entries off the firewall's hosts file. A TTL 0 is a bit
unusual in that scenario, it should be safe to set it to 1 for
everything. I committed that change to 2.0.

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@...
For additional commands, e-mail: support-help@...

Commercial support available - https://portal.pfsense.org
Permalink | Reply | 1 comment |
headers
Richard Johnson | 2 Mar 2010 03:13

<OpenVPN> Viscosity assigning wrong IP

I am using the viscosity client on a MacBook (running snow leopard) connecting to a pfsense box (v1.2.3).

For some strange reason, my viscosity client is assigning itself 172.16.101.6 (GW of 101.5) and the server
shows 101.2 assigned to client (GW of 101.1).

Has anyone else seen this before?

Thanks for any assistance that you can provide

Rich Johnson
---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@...
For additional commands, e-mail: support-help@...

Commercial support available - https://portal.pfsense.org
Permalink | Reply | 1 comment |
headers
Chris Buechler | 2 Mar 2010 03:44
Picon

Re: <OpenVPN> Viscosity assigning wrong IP

On Mon, Mar 1, 2010 at 9:13 PM, Richard Johnson
<rich.johnson@...> wrote:
> I am using the viscosity client on a MacBook (running snow leopard) connecting to a pfsense box (v1.2.3).
>
> For some strange reason, my viscosity client is assigning itself 172.16.101.6 (GW of 101.5) and the
server shows 101.2 assigned to client (GW of 101.1).
>

Sounds like it's doing as it should, if you use a /24, the tun will
initially assign .1 and .2 to itself, and the first client connection
gets .6 with .5 as its gateway.

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@...
For additional commands, e-mail: support-help@...

Commercial support available - https://portal.pfsense.org
Permalink | Reply | 0 comments |
headers
Chris Buechler | 2 Mar 2010 06:31
Picon

Re: Slow TCP connection

On Mon, Mar 1, 2010 at 5:24 AM, Hiren Joshi <josh@...> wrote:
> I'm not hitting the max states (this is set to a high enough number) and
> a tcp dump is impractical as this is not a consistent failure.
>

tcpdump is never impractical. :)  In fact it's really the only way
you're going to get any further with this. 1 in 100 or even 1 in 1000
isn't difficult to handle, just get the headers in the capture to keep
the size down, and the analysis tools in Wireshark make it easy to
pick out the problem without browsing through thousands of frames. Get
two simultaneous captures, one on LAN (or whatever internal interface)
and one on WAN.

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@...
For additional commands, e-mail: support-help@...

Commercial support available - https://portal.pfsense.org
Permalink | Reply | 12 comments |
headers
JASON JAMES | 2 Mar 2010 16:33
Picon
Picon

Squid + Content filtering

I know this has been asked several times and I have searched but came up
with no solid answers. We're running PFsense as our FW + Squid as a web
cache for a fairly large school district. We're migrating away from our
paid content filtering solution and are looking at Dans guardian. I
realize that there is no package for DG and probably will never be. What
we would like to do is run SQUID on one box and DG by itself on another.
Is this possible? We've purchased the PFSense handbook which is great btw
(thanks). There obviously isnt much information on this subject in it
however so we would greatly appreciate any information that anyone
currently has. 

Summary:

PFSense acting as Firewall + Web cache
Seperate server running Dans guardian for content filtering.

Squidguard is not really an option for us because there is no current way
to setup bypass accounts for specific users or integrate with AD. 

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@...
For additional commands, e-mail: support-help@...

Commercial support available - https://portal.pfsense.org
Permalink | Reply | 2 comments |

Gmane