Date: Fri, 07 Feb 2014 09:14:15 -0500 From: Adam McDougall <mcdouga9@egr.msu.edu> To: freebsd-pf@freebsd.org Subject: Re: pf + NAT + ICMP issues? Message-ID: <52F4EA37.9050805@egr.msu.edu> In-Reply-To: <ec460ffcc512ebdaaadaf5d47cc2d711@pyret.net> References: <ec460ffcc512ebdaaadaf5d47cc2d711@pyret.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 02/07/2014 08:16, Daniel Engberg wrote: > Hi, > > I've been tearing my hair on this one, this ruleset worked fine on 9.1 > and 9-STABLE around the same time but doesn't on HEAD (most recent box I > have is running r261486 (AMD64). I might be missing something obvious so > I guess I need a another pair of eyes. Anyhow, the issue is pretty > simple, for some reason on clients behind ping and tracert doesn't work > as they did before. > > Using ping (Windows 7) the first packet always gets a timeout and > tracert doesn't work except at the end hop. > (snip) > > # Allow ICMP > pass in quick on $ext_if inet proto icmp all icmp-type $icmp_types Can you try duplicating or replacing this rule with "pass out"? I use both pass in and out, I suppose I could just use "pass" with one rule. FYI, I only have icmp_types = "{ echoreq unreach }". > > # Allow FTPs to connect to our FTP-proxy > pass in quick on $ext_if inet proto tcp to ($ext_if) port ftp-data user > proxy >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?52F4EA37.9050805>