Fixed iChat AV thru OpenBSD PF Firewall

This has been bugging me for ages, but the fix is so simple.
I use OpenBSD for my router, and have PF (Packet Filter) running the firewall and NAT rules.

I have previously setup the port forwarding, etc. according to Apple, but never could get a successful connection using video or audio (or screen sharing).

After reading a post on the OpenBSD misc mailing list I went back and read the OpenBSD 4.5 pf.conf man page.

There is a section of the man page that states (my emphasis):

fragment reassemble
Using scrub rules, fragments can be reassembled by normalization.
In this case, fragments are buffered until they form a complete
packet, and only the completed packet is passed on to the filter.
The advantage is that filter rules have to deal only with complete
packets, and can ignore fragments. The drawback of caching frag-
ments is the additional memory cost. But the full reassembly
method is the only method that currently works with NAT. This is
the default behavior of a scrub rule if no fragmentation modifier
is supplied.

My scrub settings were such that I was filtering not complete packets, but fragments. The moment I changed the scrub settings to this:

scrub in on $ext_if all fragment reassemble


All worked perfect. I can initiate iChat calls and receive them too. Desktop sharing now works as well. All using Google talk (jabber) in iChat.

Note that in OpenBSD 4.6 or current there have been PF changes, so the wording of the scrub rule may be different. Always read the pf.conf man page for the release you are on.

Server Migration Complete

Thanks for your patience whilst I’ve been offline, and stick around!
I’ve moved off a vm infrastructure back to a real server that I’m in control of.

Translation for the Mac by Kavasoft

About 24 months ago I purchased a version of KavaSoft’s Translation Service application for the Mac. With the recent move from my old Powerbook to my new MacBookPro the application stopped working. Apparently the licence is tied not just to your purchase but to the computer you installed it on.

As I had used the Apple migration tool to move everything across to the new laptop, Translation Service stopped working. I dropped an email to the developer and literally got an email response 60 minutes later with an updated licence.

Now that’s customer service! There is nothing like a Mac application developer to renew your faith in customer service. After dealing with so many large companies for other IT support issues (Telstra I’m looking at you) – it is very refreshing to get such a favourable response. I’m a happy user and can still translate the odd French or Italian comments on flickr photo-streams I look at.

There is an updated version of Translation Services called KavaServices which sells for $20 and it does a whole lot of other conversion as well. I’m nothing more than a happy customer. The application is perfect for quick on the fly internet based language translation, and even translate right in the browser. Seen here are before/after shots from a flickr photo page.

Before Translation

After Translation – directly in the browser!

Thanks Kavasoft for the enjoyable support experience.

Server Migration complete

I’ve had an on/off outage for most of the past 4 days, so to avoid hassles I put the site into maintenance mode.

I’ve actually had to decommission my 19″ server rack and the multiple servers I had for Tech Debug. There was a DNS server, kerberos, Database and web server. All the separate functions are now hosted on one OpenBSD VM that I’ve built recently. It’s running on the only remaining “non-laptop” left in my residence, which runs 24×7.

The only delay in getting back online in the last 48 hours was the MySQL data export and import. It’s a bit convoluted, and not documented in entirely one place on the MySQL documentation site (backup here, restore here), however once done once it will be easy to repeat. I still like the simplicity of PostgreSQL administration. Specifically the backup and restore:

Backup:
pg_dumpall > savefile.dump
Restore:
psql -f savefile.dump postgres

Well, there are some prep steps you should do; but it is all in one place on their documentation page.

Let me know how the site performs on the VM.

More Work?

I’m not posting much these days since I’m currently heavily involved in a current development and build effort for a Client. (Solaris platform with Oracle 10g)

All other hours are either commuting, sleeping or playing WoW. Look forward to a number of upcoming posts on Dansguardian SQL logging, OpenBSD and of course Apple and the iPhone.

Zug Zug…. you WC3 fans will know what I mean.