NAT failure with 16.1 on Hyper-V

[andreas-p]

I've upgraded a working 15.7.25 opnsense installation hosted on Hyper-V 2012R2 to 16.1. After that, a workstation located on the LAN segment didn't NAT to the outside world any more as expected. ICMP did work, but other traffic (http, ssh) didn't reach the target. Disabling checksum offload and hardware vlan didn't solve the problem, suricata is disabled, LAN has full access.
.
Symptoms are quite strange: accessing a remote test server from the firewall does work, tcp packets receive the destination. When the workstation initiates the traffic, I can see via tcpdump on the WAN interface that NAT is performed as expected, the outgoing packet is virtually identical to a SYNC packet initiated from the firewall itself (specifically, the source address is the outgoing interface ip). Still, the packets won't arrive if initiated by the client. Apparently, the packets are dropped after passing the tcpdump tap point.
I re-checked the situation, installing a fresh 15.7.25, everything working fine; cloning it and upgrading to 16.1, bummer. I now can switch back and forth between both versions, switching on and of the symptom.

[fichtner]

Can you try the following base/kernel on a 16.1 system?

 # opnsense-update -bkr 791bdab10f3cfbed0b6a62d89d9168fb66d3eafe && /usr/local/etc/rc.reboot

[andreas-p]

Jup, that apparently patch did the trick. Thanks!

[fichtner]

Unfortunately, that's a stock FreeBSD 10-STABLE version. We've been unable to find the cause of this yet, but we are trying to pin this down. Use with care. :)

[andreas-p]

From your reply, I was wondering what the problem might be with the stock stable kernel, but uname shows me it's 10.3-PRERELEASE, so consider that question retracted ;-)

[fichtner]

some patches are missing (nat+traffic shaping, pf match keyword, pptp filter glue) we want to pin down the issue, then merge the single commit responsible into our 16.1 :)

[gitdevmod]

Maybe this is the same issue https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=203630 ?

[fichtner]

@gitdevmod thanks, looks promising... providing a new build soon.

[fichtner]

How is this one then?

# opnsense-update -bkr 16.1-hyperv && /usr/local/etc/rc.reboot

[andreas-p]

That's no different from comment 2..

[fichtner]

@andreas-p So it works? Just to be clear :)

[andreas-p]

Yes, that kernel does fix the problem on Hyper-V.

[fichtner]

I'll take two "okays" out of three, thanks guys, will be shipped in 16.1.2 on Friday and also try to push FreeBSD to add that to 10.2 errata.