Date: Tue, 10 Sep 2002 02:08:31 +0200 From: Artur Pydo <artur@pydo.org> To: Darren Reed <darrenr@reed.wattle.id.au> Cc: Mike Tancsa <mike@sentex.net>, ipfilter@coombs.anu.edu.au, stable@freebsd.org Subject: Re: FreeBSD 4.7-PRERELEASE & IPFilter Message-ID: <3D7D37FF.4090704@pydo.org> References: <5.1.1.6.0.20020908224413.01f52cd0@marble.sentex.ca> <5.1.1.6.0.20020909083757.04706910@marble.sentex.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi, I found at least one problem with Ipfilter since i upgraded my FreeBSD box from 4.6-STABLE to 4.7-PRERELEASE. It seams that some ACK packets are rejected by Ipfilter even if there are part of an legitimate open TCP connection and freezing it. In my configuration NAT and statefull inspection are activated : map external_interface internal_network/24 -> fw-ext/32 pass in quick on internal_interface proto tcp from internal_network/24 to any flags S/SA keep state keep frags The problem appears only in case of TCP connections (such as an HTTP download) between a remote host and a workstation behind the firewall. I mean the same problem does not appear if i download the same file from the remote server to the firewall box. First the transfer goes fine on the established TCP connection : # ipfstat -t Source IP Destination IP ST PR #pkts #bytes ttl workstation,1061 207.200.85.49,80 4/4 tcp 8524 6986402 119:59:55 # tcpdump -i external_interface ... 01:26:26.626680 207.200.85.49.80 > fw-ext.1061: . 3313935:3315295(1360) ack 600 win 17680 01:26:26.746358 fw-ext.1061 > 207.200.85.49.80: . ack 3315295 win 17680 (DF) 01:26:34.011442 207.200.85.49.80 > fw-ext.1061: . 3315295:3316655(1360) ack 600 win 17680 While on the internal interface : # tcpdump -i internal_interface 01:26:26.626692 207.200.85.49.80 > workstation.1061: . 3313935:3315295(1360) ack 600 win 17680 01:26:26.746331 workstation.1061 > 207.200.85.49.80: . ack 3315295 win 17680 (DF) 01:26:34.011486 207.200.85.49.80 > workstation.1061: . 3315295:3316655(1360) ack 600 win 17680 01:26:34.157138 workstation.1061 > 207.200.85.49.80: . ack 3316655 win 17680 (DF) But the last packet is blocked by the firewall with no known reason (ipflog): 10/09/2002 01:26:34.157159 internal_interface @0:1 b workstation,1061 -> 207.200.85.49,80 PR tcp len 20 40 -A IN At this point all the following ACK packets as an answer for the retransmitted incoming packets are rejected and the TCP connection is frozen. I can easily reproduce this problem and can send more information if you need to diagnose it. If i flush the rules (ipf -Fa) everything goes OK. FYI, Ipfilter is statically built in the kernel. Hope it helps, Best regards, Artur. Mike Tancsa wrote: > > Thanks. Are the changes correct BTW ? I am going to cc to stable as a > number of people have noted and asked this question. > > ---Mike > > At 10:35 PM 09/09/2002 +1000, Darren Reed wrote: > >> In some email I received from Mike Tancsa, sie wrote: >> > The filtering works on my machine... Havent tried NAT yet. BTW, are >> those >> > differences mentioned in the mailing list deliberate ? >> >> No. I suspect they're mostly from people fixing problems when they're >> making changes to the FreeBSD kernel. >> >> Darren To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3D7D37FF.4090704>