From owner-freebsd-bugs@FreeBSD.ORG Wed Jun 9 12:30:04 2010 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B5079106564A for ; Wed, 9 Jun 2010 12:30:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (unknown [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 79BD08FC22 for ; Wed, 9 Jun 2010 12:30:04 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id o59CU4sS039885 for ; Wed, 9 Jun 2010 12:30:04 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id o59CU4Ds039883; Wed, 9 Jun 2010 12:30:04 GMT (envelope-from gnats) Resent-Date: Wed, 9 Jun 2010 12:30:04 GMT Resent-Message-Id: <201006091230.o59CU4Ds039883@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Dmitriy Demidov Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0A6011065676 for ; Wed, 9 Jun 2010 12:23:32 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id EE5428FC1E for ; Wed, 9 Jun 2010 12:23:31 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o59CNV03062419 for ; Wed, 9 Jun 2010 12:23:31 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id o59CNUql062418; Wed, 9 Jun 2010 12:23:30 GMT (envelope-from nobody) Message-Id: <201006091223.o59CNUql062418@www.freebsd.org> Date: Wed, 9 Jun 2010 12:23:30 GMT From: Dmitriy Demidov To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: misc/147720: ipfw dynamic rules and fwd X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Jun 2010 12:30:04 -0000 >Number: 147720 >Category: misc >Synopsis: ipfw dynamic rules and fwd >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Jun 09 12:30:04 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Dmitriy Demidov >Release: FreeBSD 7-STABLE >Organization: >Environment: FreeBSD evo.local.home 7.3-PRERELEASE FreeBSD 7.3-PRERELEASE #0: Sat Feb 20 22:57:09 EET 2010 root@evo.local.home:/usr/obj/usr/src/sys/STABLE i386 >Description: There is one bug with ipfw keep-state rules and fwd action. You are unable to make source based routing of incoming connections using this ruleset: ======= # $ext_if1 - ISP1 # $gw1 - ISP1 GW # $ext_if2 - ISP2 # $gw2 - ISP2 GW # $int_if - internal net ipfw add 100 skipto 300 tag 1 in recv $ext_if1 keep-state ipfw add 200 skipto 300 tag 2 in recv $ext_if2 keep-state ipfw add 300 allow { recv $ext_if1 or recv $ext_if2 } ipfw add 400 allow in recv $int_if ipfw add 500 fwd $gw1 tagged 1 ipfw add 600 fwd $gw2 tagged 2 ======= To make it working you should patch /sys/netinet/ipfw/ip_fw2.c with this: ==== (find this line) if (!q || dyn_dir == MATCH_FORWARD) (change it to this) if (sa->sin_port && (!q || dyn_dir == MATCH_FORWARD)) ==== This problem is presend in FreeBSD 9-CURRENT as well. Can somebody please merge this patch to CURRENT? Credits for this patch goes to Vadim Goncharov nuclight.livejournal.com/124348.html >How-To-Repeat: have FreeBSD host with two NIC's connected to different networks with different GW each. Applay ipfw rules from example provided. Start some service (SSH/Apache/etc). Make a try to connect to connect to service from network behing GW that is not configured as default gateway on FreeBSD host - answer will go via second NIC/default GW. keep-state ruleset do not works. >Fix: applay patch >Release-Note: >Audit-Trail: >Unformatted: