Current-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Revisiting: ipfilter/ipnat problems on -current

Some of you may remember many months ago when I started having some strange problems with ipfilter/ipnat, right after a new version was imported. Among other odd behavior, I was having difficulty mounting NFS file systems.

After several attempts to find a problem, I worked around it by using NFS TCP mounts, rather than the default of UDP. All seemed to be well and I sort of forgot about it.

Well, a few days ago I updated my systems to -current, and something very odd happened. :)

The update was done using ' install=/' and RELDIR was on one of my NFS mounted filesystems. Most everything seems to work, except /usr/X11R6/bin/xrdb fails with a "built-in" error from the Xserver.

Trying to narrow this down a bit, I decided to verify the integrity of the NFS file systems. I logged in to the NFS server and ran cksum on all of the X install sets, and then I ran the same cksum command on the system-with-the-problem. Interestingly, I got different results for one of the files. So I unmounted and remounted the file system and reran cksum, and got wrong results for a different file. Repeat the umount, mount, cksum steps again, and got still different results!

Since these NFS problems only happen on the single client which also runs ipfilter/ipnat, and turning ipfilter/ipnat off avoids the problem, I'm pretty sure I don't have a problem on the NFS server, nor on the network that connects everything together.

One additional datapoint that might be relevant: ALL of my systems, including all the NFS clients and the NFS server, run an IPv4 network only - no INET6 configured. I'm going to try enabling INET6 on the machine-that-has-the-problem to see if that makes any difference.

If anyone else has any clues on how to go about resolving this, I'd really appreciate it. The obvious solution might be "turn off ipfilter/ipnat" but I need ipnat - I don't have enough fixed IP addresses for everything - and I'm not willing to go out and buy a stand-alone device. :)

|   Paul Goyette   | PGP DSS Key fingerprint: |  E-mail addresses:   |
| Customer Service | FA29 0E3B 35AF E8AE 6651 |   |
| Network Engineer | 0786 F758 55DE 53BA 7731 | |

Home | Main Index | Thread Index | Old Index