[SOLVED] SSH Port Forwarding unstable since update to 25.1.1

[davrot]

I had a happy setup with a one firewall where I have ports forwarded to three ssh gateways. Everything worked fine. The users could work for hours over these connections.

Today I did an update to 25.1.1. Now these ssh connections are unstable with random lifetimes. The duration for how long the ssh connects are alive is between sub-seconds(I just see a "Last login: Mon Feb 24 01:26:46 2025 from X.X.X.X" and then dead) and a few minutes. Then I get a "client_loop: send disconnect: Broken pipe".

Also I went to system_advanced_firewall.php and tried Firewall Optimization with conservative, which makes not difference.   

The ssh gateways are happily doing their jobs. I have a second way into the network via a cisco anyconnect that skips the firewall. These ssh connections to the ssh gateways are stable.

I don't see anything in the Opnsense log files that even resembles an error. The firewall log also shows nothing special at all.

I am a bit out of ideas. Help? :-)   

[meyergru]

This looks like a case of split routes.

Firewall: Advanced: Disable Reply-To ?

[dseven]

Smells like an MTU issue to me, but I don't know why that would suddenly appear after an upgrade.

[davrot]

It looks like that they (the uni infrastructure) fucked up something upstream that confused the poor little OpnSense firewall. They rebooted their cisco equipment and now the ssh port forwarding is stable again.

Sorry! I haven't expected this kind of problem. Especially that it occurred at the same time...