11:29 <zofu> hannes: no restart of the m-fw vm involved. no need to add persistent storage for NAT/fw state.

11:29 <zofu> hannes: but it seems to be discarding (and corrupting) all state for all interfaces every time an interface gets added. this is mildly annoying for long-running connections like irc, ssh ...

11:30 <zofu> (and right now i cant post it on github because for some reason i can not connect to github anymore and i dont want to restart all the things 27 more times at the moment...)

11:31 <zofu> additional question is ... is the mirage-fw supposed to be "stateful"? then thats broken currently too because it starts natting tcp connections that violate the state diagram hard.

11:31 <hannes> zofu: there's no state tracking in NAT afair

11:32 <hannes> in the OCaml NAT library is what I meant

11:32 <zofu> and the rest of the m-fw isnt doing state tracking either?

11:32 <hannes> i don't think so

11:33 <hannes> and thanks for your reply, marek said similar. i'll look into this with steffi (there must be some code that resets the nat tables then).

11:33 <hannes> zofu: has there been state tracking with earlier m-fw?

11:33 <zofu> i am not sure.

11:34 <zofu> it is possible that the behavior i interpreted as state tracking is really just packets from the "outside" bouncing because of lack of NAT entry.

11:35 <zofu> (if you restart a m-fw hard, for the first few minutes it will spam a lot of "waha, dropping this packet on the floor!" for connections that were established before the restart. that is very ok.)

11:35 <hannes> (I generally agree that state tracking would be good to have)

11:35 <hannes> but I would as well be in a more happy state to have this rather big PR upstreamed before adding more new features ;)

11:36 <zofu> agreed. and i am still ok with merging it as-is, as long as we move on to getting the nat-table-reset into an open issue right away.

12:25 <mezu> (that reconnect was caused by starting a buildvm for testing the fix. ;)

13:51 <jiji> switched main mfw back to the 20200318 build for now, can still test with some that have less impact.