Date: Thu, 04 Nov 2004 15:08:30 +0100 From: Andre Oppermann <oppermann@networx.ch> To: Guido van Rooij <guido@gvr.org> Cc: freebsd-net@freebsd.org Subject: Re: dummynet setting ifp pointer in mbuf? Message-ID: <418A37DE.694C18AA@networx.ch> References: <20041104121602.GA89896@gvr.gvr.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Guido van Rooij wrote: > > I am having problems combining ipf's ipnat rules with dummynet. The > reason is that if I use dummmynet queues configured to > be used outbound (queue .... out xmit if), then ipnat starts > applying rewriting of RDR rules on the wrong interface. > > e.g.: > firewall has 2 interfaces: if0 and if1 > if i say: > rdr from any to 1.2.3.4 port 22 -> 2.2.3.4 port 2222 > then ipfilter should rewrite incoming packets on if0 (and > outgoing packets as well). > With a dummynet rule like > queue 2 tcp from any 22 to any out xmit if0 > ipf starts rewriting on if1, which leads to blocked packets as > the rewritten packet does not match the state entry for the connection. > > When looking in the dummynet source I see (rev 1.75, line 1190): > pkt->ifp = fwa->oif; > So it seems the queued packets interface is set to the outgoing interface. > But according to me, that is wrong. > > Can a dummynet expert verify if my analysis is correct or come up > with a real explanation if not? Which version of FreeBSD do you run? Rev 1.75 of ip_dummynet.c is relatively old. The problem you are having is not that dummynet is saving the ifp (it needs that for bridged packets) but that it is using it for IP packets. I've fixed it in 1.83 of ip_dummynet.c together with pfil_hooks move of ipfw2. -- Andre
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?418A37DE.694C18AA>