# PF loses states



## konradk (Jul 2, 2014)

Hello,

I have a problem with pf and NAT.

*A*lmost always morning states are lost. Table state => current entries (from `pfctl -si`) floats between values i.e. 2000 and 500 states. When I set an IP which is translated, connection*s* are dropped after a few seconds. Below is `pfctl -ss` output (during TCP transmis*s*ion)


```
# pfctl -ss | grep -i 10.7.100.2
all tcp 79.xxx.xxx.xxx:51048 (10.7.100.2:56851) -> 78.88.xxx.xxx:5001       ESTABLISHED:ESTABLISHED
 # pfctl -ss | grep -i 10.7.100.2
all tcp 79.xxx.xxx.xxx:51048 (10.7.100.2:56851) -> 78.88.xxx.xxx:5001       ESTABLISHED:ESTABLISHED
# pfctl -ss | grep -i 10.7.100.2
all tcp 79.xxx.xxx.xxx:51048 (10.7.100.2:56851) -> 78.88.xxx.xxx:5001       ESTABLISHED:ESTABLISHED
all tcp 79.xxx.xxx.xxx:56520 (10.7.100.2:56850) -> 78.88.xxx.xxx:5001       SYN_SENT:CLOSED
# pfctl -ss | grep -i 10.7.100.2
all tcp 79.xxx.xxx.xxx:56520 (10.7.100.2:56850) -> 78.88.xxx.xxx:5001       SYN_SENT:CLOSED
```

When I use iperf and UDP connections, it look*s* like pf close*s* translation and create*s* a new one with a new port.

pftop also looks odd, expire time for every state is 00:00:00.


```
PR        DIR SRC                                           DEST                                                   STATE                AGE       EXP     PKTS    BYTES
tcp       Out 79.xxx.xxx.xxx:53297                          81.19..xxx.xxx:443                                TIME_WAIT:TIME_WAIT    00:00:10  00:00:00        4      281
tcp       Out 193.xxx.xxx.xxx:51172                           193.109..xxx.xxx:80                               TIME_WAIT:TIME_WAIT    00:00:10  00:00:00        3     1946
```

/etc/pf.conf:


```
set limit { states 100000, frags 10000 }
set optimization aggressive
set loginterface vlan4010
set skip on lo0
set state-policy floating


nat_addr_vlan32="79.xxx.xxx.xxx"
nat_addr_vlan119="79.xxx.xxx.xxx"
nat_addr_vlan15="79.xxx.xxx.xxx"
nat_addr_vlan227="79.xxx.xxx.xxx"


prefix_vlan32="10.7.100.0/24"
prefix_vlan119="{10.7.18.0/24 10.19.18.0/24 10.69.119.0/24 10.9.95.0/28}"
prefix_vlan15="{10.7.33.0/24 10.19.33.0/24 10.69.15.0/24}"
prefix_vlan227="{10.7.133.0/24}"

nat log on vlan4010 from $prefix_vlan32 to ! <nasze> -> $nat_addr_vlan32
nat on vlan4010 from $prefix_vlan119 to ! <nasze> -> $nat_addr_vlan119
nat on vlan4010 from $prefix_vlan15 to ! <nasze> -> $nat_addr_vlan15
nat on vlan4010 from $prefix_vlan50 to ! <nasze> -> $nat_addr_vlan50
nat on vlan4010 from $prefix_vlan227 to ! <nasze> -> $nat_addr_vlan227
```

A reboot resolve*s* this problem. I tried disable/enable/flush all pfctl and nothing worked. When the system starts up it works properly about 1-2 days (state count does not flap, pf keeps states)

I can past*e* output with syslog when I set `pfctl -x m`.

 FreeBSD 10.0-RELEASE-p5.


----------

