Hi
I'm setting up a new redundant pair of firewalls using OpenBSD 5.3, pf & CARP. Everything seems to be working fine, multiple public IP's on the carp interface are nat'ed to different internal IP's, the problem is with ssh sessions passing through pf. The time out after a couple of minutes, sometimes while I am editing configs. This does not apply to ssh sessions to the firewall itsself, only to those passing through nat, connected to Debian 7.1 boxes on the internal network. This does not seem to have anything to do with Debian or client configuration, as when I route traffic via the old gateway that I want to replace the connection stays up for hours, same thing when I connect to the new firewall directly. Only nat'ed connections get dropped.
This is quite annoying, obviously the workaround is to ssh to the firewall and then to the internal machine from it but I'd rather not let people on the firewalls
my pf.conf below, mh0mon01 is the machine behind nat to which my ssh connections are dropped.
Code:
ext_if="em0"
int_if="em1"
sync_if="em2"
lo_if="lo0" # loopback interfaceA
tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"
# Gateways
gateway206="x.X.206.1"
# routing X.X.229.0 subnet
gateway229="X.X.229.1"
gateway228="X.X.228.1"
defaultgw="X.X.228.10"
#
mh0mon01="10.1.206.80"
mh0mon01_pub="X.X.206.80"
nl6app01="10.1.229.61"
nl6app01_pub="X.X.229.61"
# Unroutable addresses
martians = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12,10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 0.0.0.0/8, 240.0.0.0/4 }"
# options
set block-policy return
set loginterface $ext_if
set skip on lo
match in all scrub (no-df)
# nat/rdr
match out on $ext_if from !$ext_if to any nat-to $defaultgw
match in quick on $ext_if inet proto tcp from any to $nl6app01_pub port { http, https, ssh } rdr-to $nl6app01
match in quick on $ext_if inet proto tcp from any to $mh0mon01_pub port { http, https } rdr-to $mh0mon01
match in quick on $ext_if inet proto tcp from any to $mh0mon01_pub port ssh rdr-to $mh0mon01
# Block traffic from unroutable addresses on external interface
block drop in quick on $ext_if from $martians to any
block drop out quick on $ext_if from any to $martians
# by default block all incoming traffic
block in all
pass out keep state
anchor "ftp-proxy/*"
pass in quick on $int_if inet proto tcp to any port ftp divert-to 127.0.0.1 port 8021
antispoof quick for { lo $int_if }
# Allow access to mh0mon01
pass in inet proto tcp from any to $mh0mon01 port { http, https } flags S/SA synproxy state
#pass in inet proto tcp from any to $mh0mon01 port ssh flags S/SA synproxy state
pass in inet proto tcp from any to $mh0mon01 port ssh flags S/SA
# Allow traffic for application server
pass in inet proto tcp from any to $nl6app01 port { http, https, ssh } flags S/SA synproxy state
# Allow ssh acccess to firewall
pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
#pass in on $ext_if inet proto tcp from any to $mh0mon01 port 80 flags S/SA synproxy state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $int_if
# -----------------------------------------------------------------------------
# PFSYNC (between)
# -----------------------------------------------------------------------------
pass quick on $sync_if inet proto pfsync
# -----------------------------------------------------------------------------
# CARP
# -----------------------------------------------------------------------------
pass quick on { $ext_if $int_if } proto carp keep state
# By default, do not permit remote connections to X11
block in on ! lo0 proto tcp to port 6000:6010
#END
I tried setting /etc/ssh/sshd_config parameters
KeepAlive yes
ClientAliveInterval 30
but it does not help, my ssh sessions are dropped anyway, even when they are not idle. I noticed that it always happens when I change the CARP Master, it did not happen on earler versions of OpenBSD though.
my kernel settings for CARP
Code:
net.inet.carp.allow=1
net.inet.carp.preempt=1
net.inet.carp.log=2
Any idea how to prevent dropping ssh connections ? Any hints welcomed
EDIT
It does not happen when I shut down one of the 2 redundant firewalls. On a single firewall the ssh connection through nat is stable, it can stay up for a few hours. However when I bring the other firewall up it breaks.
Not sure if that has anything to do with these firewalls being hosted on VMWare Vsphere environment. I enabled preemption on the virtual switches, I even created separate port groups for these firewalls, but it did not help.
Thanks
Greg
