Date: Sun, 2 Aug 2009 09:02:53 GMT From: Dmitriy Demidov <dima_bsd@inbox.lv> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/137346: ipfw nat redirect_proto is broken Message-ID: <200908020902.n7292rKS038198@www.freebsd.org> Resent-Message-ID: <200908020910.n729A2sf010506@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 137346 >Category: kern >Synopsis: ipfw nat redirect_proto is broken >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Aug 02 09:10:02 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Dmitriy Demidov >Release: FreeBSD 7.2-STABLE >Organization: >Environment: FreeBSD hius.local.home 7.2-STABLE FreeBSD 7.2-STABLE #0: Sun Jul 19 13:01:10 EEST 2009 root@hius.local.home:/usr/obj/usr/src/sys/STABLE i386 >Description: Looks like redirect_proto in ipfw nat is broken. I have NAT router with following config: fxp0 - LAN (192.168.1.1) em0 - WAN (8.9.0.100) # ipfw show 00100 214 45088 allow ip from any to any via lo0 00200 0 0 deny ip from any to 127.0.0.0/8 00300 0 0 deny ip from 127.0.0.0/8 to any 00400 2 100 count ip from any to any 00500 0 0 allow ip from any to any via fxp0 00600 2 100 count ip from any to any 00700 2 100 nat 1 log logamount 100 ip from any to any via em0 00800 0 0 count ip from any to any 65535 0 0 deny ip from any to any # ipfw nat 1 show nat 1: icmp=0, udp=0, tcp=2, pptp=0, proto=0, frag_id=0 frag_ptr=0 / tot=2 # ipfw nat 1 show config ipfw nat 1 config log redirect_proto tcp 192.168.1.2 8.9.0.100 On NAT router I don not have SSH daemon running. If I make a try to connect to 192.168.1.2 SSH (81.91.0.122 -> 8.9.0.100:22) from Internet via redirect_proto I got error: tcpdump -i 2 -vvv -n -l ip tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes 22:27:35.459508 IP (tos 0x0, ttl 64, id 51316, offset 0, flags [DF], proto TCP (6), length 60) 81.91.0.122.35654 > 8.9.0.100.22: S, cksum 0x6bc2 (correct), 2918273360:2918273360(0) win 5840 <mss 1460,sackO K,timestamp 1743140 0,nop,wscale 6> 22:27:35.459638 IP (tos 0x0, ttl 64, id 298, offset 0, flags [DF], proto TCP (6), length 40) 8.9.0.100.22 > 81.91.0.122.35654: R, cksum 0x839f (correct), 0:0(0) ack 2918273361 win 0 So looks like redirect_proto do not works as expected here - it passes all incoming traffic into local machine (it do not alter destination IP address of packet as expected). >How-To-Repeat: Make a try to use redirect_proto in any ipfw nat configuration. >Fix: >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200908020902.n7292rKS038198>