Brian,
Despite the fact that I get tons of State Failures I see this strange message

:
Jun 13 11:05:01 spock /bsd: pf: NAT proxy port allocation (50001-65535)

failed
Can this be the cause of my errors?
Andy.
-----Oorspronkelijk bericht-----

Van: Brian A. Seklecki [mailto:lavalamp@spiritual-machines.org]

Verzonden: dinsdag 12 juni 2007 22:03

Aan: Geraerts Andy

CC: misc@openbsd.org

Onderwerp: RE: Sometime NAT, sometimes NOT?
pfctl -x loud  && tail -f /var/log/messages
~BAS
On Mon, 11 Jun 2007, Geraerts Andy wrote:
>

quoted text
>>> We have an OpenBSD firewall running for a while now. Since a few days we

>>> encounter some sort of selective natting. I try to ping a host, I get

reply,

quoted text
>>> and 2 minutes later I try to ping the same host and I dont get replies.

>

>> So despite the state being created in both instances, you see a packet

>> egress your external interface with the source address of the internal

>> host instead of the external interface of the NAT box?

>

> We indeed see the state being created. The packet egresses on the external

interface without NAT. So the ip packet contains the source ip address of my

laptop and therefor further on the path gets blocked because it isn't natted.

A few seconds/minutes later I try again and everything works again.

quoted text
>

> Is there a way to see why it isn't doing the NAT?

>

> (There are around 80 interfaces (vlan + carp) on the box.)

>

> Regards,

>

> Andy.

No virus found in this outgoing message.

Checked by AVG Free Edition.

Version: 7.5.472 / Virus Database: 269.8.15/847 - Release Date: 12/06/2007

21:42
______________________________________________________________________
This email and any files transmitted with it are confidential and intended

solely for the use of the individual or entity to whom they are addressed.

If you have received this email in error please notify the system manager at :

systeembeheer@cegeka.be or call +32-(0)11-240234.

This footnote also confirms that this email message has been swept by Sophos

for the presence of computer viruses.

______________________________________________________________________