From owner-freebsd-pf@FreeBSD.ORG Wed Jul 20 05:46:45 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D7C8C16A41F for ; Wed, 20 Jul 2005 05:46:45 +0000 (GMT) (envelope-from d_a_d_a_sh@yahoo.com) Received: from web32401.mail.mud.yahoo.com (web32401.mail.mud.yahoo.com [68.142.207.194]) by mx1.FreeBSD.org (Postfix) with SMTP id 5FFCA43D46 for ; Wed, 20 Jul 2005 05:46:45 +0000 (GMT) (envelope-from d_a_d_a_sh@yahoo.com) Received: (qmail 68434 invoked by uid 60001); 20 Jul 2005 05:46:44 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=RqUIpVGkrMHbBK/zqQLcRfJFXV38/8YKIIDd6OSy4/of4i6/mYoz2jnNI88o96TI0epMFo+eiOt5yBEZCnoQDClL5f3lOJB63gFxbl7KVD0W9buZtwub/X7o19YX0XJ22sCAyIDchS002N9ZrNaokKLOgtz+v81LZKYyYWYeg3I= ; Message-ID: <20050720054644.68432.qmail@web32401.mail.mud.yahoo.com> Received: from [217.218.230.2] by web32401.mail.mud.yahoo.com via HTTP; Tue, 19 Jul 2005 22:46:44 PDT Date: Tue, 19 Jul 2005 22:46:44 -0700 (PDT) From: Pejman Moghadam To: freebsd-pf@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Subject: NAT problem with icmp X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Jul 2005 05:46:46 -0000 Hi, Here is simple explanation : This is my pf.conf extif="{ ed0 }" extip="{ (ed0) }" table { 192.168.1.0/24 } nat on $extif from to any -> $extip pass all I want to ping from my lan stations to a public dns server like 192.9.9.3 look at my state table: # pfctl -ss self icmp 192.168.1.18:512 -> 1.2.3.4:512 -> 192.9.9.3:512 0:0 take a look to icmp traffic: internal interface : # tcpdump -c 10 -i dc0 -nq icmp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on dc0, link-type EN10MB (Ethernet), capture size 96 bytes 10:00:51.538006 IP 192.9.9.3 > 192.168.1.18: icmp 40: echo reply seq 37394 10:00:51.671439 IP 192.168.1.19 > 192.9.9.3: icmp 40: echo request seq 43538 10:00:52.199114 IP 192.168.1.18 > 192.9.9.3: icmp 40: echo request seq 37650 10:00:52.538007 IP 192.9.9.3 > 192.168.1.18: icmp 40: echo reply seq 37650 10:00:52.672876 IP 192.168.1.19 > 192.9.9.3: icmp 40: echo request seq 43794 10:00:53.210683 IP 192.168.1.18 > 192.9.9.3: icmp 40: echo request seq 37906 10:00:53.554918 IP 192.9.9.3 > 192.168.1.18: icmp 40: echo reply seq 37906 10:00:53.674441 IP 192.168.1.19 > 192.9.9.3: icmp 40: echo request seq 44050 10:00:54.212218 IP 192.168.1.18 > 192.9.9.3: icmp 40: echo request seq 38162 10:00:54.551131 IP 192.9.9.3 > 192.168.1.18: icmp 40: echo reply seq 38162 10 packets captured 26 packets received by filter 0 packets dropped by kernel external interface: # tcpdump -c 10 -i ed0 -nq icmp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ed0, link-type EN10MB (Ethernet), capture size 96 bytes 10:02:42.839665 IP 192.168.1.19 > 192.9.9.3: icmp 40: echo request seq 6419 10:02:42.909906 IP 1.2.3.4 > 192.9.9.3: icmp 40: echo request seq 275 10:02:43.248794 IP 192.9.9.3 > 1.2.3.4: icmp 40: echo reply seq 275 10:02:43.841123 IP 192.168.1.19 > 192.9.9.3: icmp 40: echo request seq 6675 10:02:43.921558 IP 1.2.3.4 > 192.9.9.3: icmp 40: echo request seq 531 10:02:44.263806 IP 192.9.9.3 > 1.2.3.4: icmp 40: echo reply seq 531 10:02:44.842665 IP 192.168.1.19 > 192.9.9.3: icmp 40: echo request seq 6931 10:02:44.923035 IP 1.2.3.4 > 192.9.9.3: icmp 40: echo request seq 787 10:02:45.262390 IP 192.9.9.3 > 1.2.3.4: icmp 40: echo reply seq 787 10:02:45.844227 IP 192.168.1.19 > 192.9.9.3: icmp 40: echo request seq 7187 10 packets captured 12 packets received by filter 0 packets dropped by kernel The problem is : I can pinging to 192.9.9.3 from only one of my stations.(192.168.1.18) Other stations show "Request timed out." So... is there any problem with nating icmp packects in pf ? Or this is just my mistake in pf.conf Thanks in advance __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com