ipfilter hangs

[Randy Mikesell]

Whenever I start ipfilter, it works fine for a minute or two and then hangs. The system is still running and I can access it through the console, but the network no longer responds.

ipfstat still shows packets being passed.

netstat shows an increase in incomming and outgoing packets, but there is no response to the terminal.

When I turn off ipfilter, a minute or two later everything works (even the commands that I typed and got no response on).

Contents of my ipf.conf file:

pass in from any to any
pass out from any to any
block in log proto icmp from any to any

I have tried many variations and the results have always been the same.

Any suggestions?

Randy

[Ron Kinner]

Does it still lock if you drop the last line? If not and you are running 11.0 you need to allow echo replies from the gateway or turn off dead gateway detection with ndd. The default time without contact to the gateway before declaring it dead is about 3 minutes and it should come back in about the same time or less.

Ron