From owner-freebsd-ipfw@freebsd.org Thu Mar 10 20:33:44 2016 Return-Path: Delivered-To: freebsd-ipfw@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A1B24ACA174 for ; Thu, 10 Mar 2016 20:33:44 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "vps1.elischer.org", Issuer "CA Cert Signing Authority" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 65D60F0C; Thu, 10 Mar 2016 20:33:44 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from julian-mbp3.pixel8networks.com (50-196-156-133-static.hfc.comcastbusiness.net [50.196.156.133]) (authenticated bits=0) by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id u2AKXewo087574 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Thu, 10 Mar 2016 12:33:41 -0800 (PST) (envelope-from julian@freebsd.org) Subject: Re: ipwf dummynet vs. kernel NAT and firewall rules To: Ian Smith , Don Lewis References: <201603092302.u29N2IYm012240@gw.catspoiler.org> <20160310165323.U61428@sola.nimnet.asn.au> Cc: freebsd-ipfw@freebsd.org, fjwcash@gmail.com From: Julian Elischer Message-ID: <56E1DA1F.5030703@freebsd.org> Date: Thu, 10 Mar 2016 12:33:35 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: <20160310165323.U61428@sola.nimnet.asn.au> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 20:33:44 -0000 On 9/03/2016 10:53 PM, Ian Smith wrote: > On Wed, 9 Mar 2016 15:02:18 -0800, Don Lewis wrote: > > On 9 Mar, Don Lewis wrote: > > > On 9 Mar, Don Lewis wrote: > > >> On 9 Mar, Don Lewis wrote: > > >>> On 9 Mar, Freddie Cash wrote: > > >>>> > > >>>> ?Do you have the sysctl net.inet.ip.fw.one_pass set to 0 or 1? > > >>> > > >>> Aha, I've got it set to 1. > > I observe that in 99 cases out of 100, the default of 1 is undesired, > but it's too late to do anything but advise people - thanks Freddie! > > [..] > > > >> I just read the fine man page and is says that after re-injection the > > >> packet starts with the next rule ... cool! > > Make sure the next rule has a higher number; in some (but not all?) uses > of one_pass actually restart with the next higher-numbered rule. the code in reinjection of divert packets takes the rule number that matches, adds one and skips to that (or higher). I think dummynet does the same but have not checked. > > [..] > > > It looks like the problem was an interaction between > > net.inet.ip.fw.one_pass, my NAT rules, and my keep-state rules. My nat > > rule was: > > nat 123 ip4 from any to any via re0 > > so it was matching by outgoing DNS queries even though they didn't need > > to be NATed. I think that when net.inet.ip.fw.one_pass=1, the DNS > > queries were totally being handled by NAT and not using the keep-state > > rule at all. I'm wondering if net.inet.ip.fw.one_pass=0 was interfering > > with setting the ipfw dynamic state and the response packet was getting > > blocked after it was reinjected by NAT. > > > > In any case, changing my NAT rules to this make things work: > > > > nat 123 ip4 from internal/24 to any out xmit re0 > > nat 123 ip4 from any to me in recv re0 > > 'in recv' and 'out xmit' are always clearer than 'via', and someimes (as > here) necessary. Another way, assuming you want to NAT everything from > internal net(s) would be: > > nat 123 ip4 from any to any out xmit re0 recv $internal_if > > > The "me" in the second rule should really be the address of re0, but > > that's not readily available. > > 'me' is fine in most cases, unless you are having other addresses routed > to you, eg an external /29 or such, if those addresses also match 'me'. > > Glad you've got it sorted. > > cheers, Ian > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" >