Date: Mon, 09 Nov 2015 08:18:32 -0500 From: Shawn Webb <shawn.webb@hardenedbsd.org> To: Kristof Provost <kp@freebsd.org> Cc: freebsd-current@freebsd.org Subject: Re: pf NAT and VNET Jails Message-ID: <5815854.WJiA8b3P58@hbsd-dev-laptop> In-Reply-To: <D8AAC66A-ED1D-4A6C-9CCF-447CA788073A@FreeBSD.org> References: <CAExMvs=jVsASLyiqU9nTpir0Hy_s_DfChgf4XKeGWv-8yojNBw@mail.gmail.com> <13324720.omGDCH0sVj@hbsd-dev-laptop> <D8AAC66A-ED1D-4A6C-9CCF-447CA788073A@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart4741153.VGaV7FWRE0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"
On Thursday, 05 November 2015 11:45:25 PM Kristof Provost wrote:
> > On 05 Nov 2015, at 17:25, Shawn Webb <shawn.webb@hardenedbsd.org> w=
rote:
> > I've figured it out. I've removed all rules and went with a barebon=
es
> > config.
> >=20
> > Right now, the laptop I'm using for NAT has an outbound interface o=
f wlan0
> > with an IP of 129.6.251.181 (from DHCP). The following line works:
> >=20
> > nat on wlan0 from any to any -> 129.6.251.181
> >=20
> > The following line doesn't:
> >=20
> > nat on wlan0 from any to any -> (wlan0)
> >=20
> > Nor does this:
> >=20
> > nat on wlan0 from any to any -> wlan0
> >=20
> > From the Handbook, the lines that don't work are prefered especiall=
y the
> > first non-working line, since using (wlan0) would cause pf to pick =
up
> > wlan0's IP dynamically (which is good, since wlan0 is DHCP'd).
> >=20
> > So it seems at some point of time, doing NAT dynamically broke.
>=20
> So far I=E2=80=99ve had no luck reproducing this.
> With pf.conf:
> nat on vtnet0 from any to any -> (vtnet0)
> pass in
> pass out
>=20
> And setup code:
> ifconfig bridge0 create
> ifconfig epair0 create
> ifconfig epair0a up
> ifconfig epair0b up
> ifconfig bridge0 addm epair0a
>=20
> jail -c name=3Dtest host.hostname=3Dtest vnet persist
> ifconfig epair0b vnet test
>=20
> ifconfig bridge0 inet 10.0.0.1/24
>=20
> jexec test ifconfig epair0b 10.0.0.2/23
> jexec test route add default 10.0.0.1
>=20
> # Activate routing
> sysctl net.inet.ip.forwarding=3D1
>=20
> pfctl -e
> pfctl -g -f pf.conf
>=20
> Then I run exec test ping 8.8.8.8, which works as expected.
>=20
> My home routing is running CURRENT, used vnet jails and also doesn=E2=
=80=99t seem to
> be triggering the problem.
>=20
> Perhaps we=E2=80=99re still missing a component of the problem, but r=
ight now I have
> no idea what that would be.
>=20
> Hmm. Perhaps=E2=80=A6 do you happen to know in what order things are =
done during
> startup? Perhaps it=E2=80=99s related to the fact that wlan0 is both =
wifi and DHCP,
> in the sense that pf is configured before the IP is assigned to the
> interface.
>=20
> Can you try reloading pf with the (wlan0) rule? (Just pfctl -g -f
> /etc/pf.conf should do the trick).
I'm using iocage for jailing.
It's now looking like pf is back to being broken for me. I've tried eve=
ry=20
combination possible, even hardcoding the values:
nat on wlan0 from {192.168.6.0/24, 192.168.7.0/24} to any -> 129.6.251.=
181
pass in
pass out
I have zero idea why this isn't working. It seems that from the documen=
tation,=20
I'm doing everything right. I can see from tcpdump that the packets are=
=20
getting forwarded, but without the src IP address being rewritten to=20=
129.6.251.181.
tcpdump output for a single ICMP packet, pinging to 8.8.8.8:
08:12:30.544462 IP 192.168.7.3 > 8.8.8.8: ICMP echo request, id 28131, =
seq 0,=20
length 64
That src IP should say 129.6.251.181.
Thanks,
=2D-=20
Shawn Webb
HardenedBSD
GPG Key ID: 0x6A84658F52456EEE
GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE
--nextPart4741153.VGaV7FWRE0
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJWQJ0oAAoJEGqEZY9SRW7u0hUQAMcno5u+XCm2fY3zVnyQBL/A
kZ8uDoUMShjxZdbJL0saR8AONDuvTDr/C8fKMx0ir1c1ctQSFDVD4+7kvcY4RiN3
uphcCVvvCHmI9doIgVSVvqid3BvBwgtNoZUfbqZxEZeWPJxVvkcz+n97yGRUhKc9
xlim1izF9Mh5+bzD3fAiPtjF8d1p+uahU2UqZpA3ylACWi7KJyySU25CdCh1y3gs
qHHtxYlF194qgJB3SN6BA7GfCm0lETJcGb9Gy01f+8MscxN7bEqnPEFW+ClHF2BK
fZ8qqRl2XpFNzPrkdc3XFqij1mv97J7a0wHhW5/OLZ+nNUtq0BmDiuTYp1+/IR41
/l4mGpHOyO8wCftx5knRWsW6y8UgX2bZBKi2IhZlzLhUJAEO994Tbt6IsoHcmqAE
8u492qgjacE3AZR8VYaVrgBY10MDXIMplZNWbKhNGasnLVXxb3EqFm59n2UTaXVj
6ITKJ6BwzS4bHfjhwx07glSGojNOEHRtYwsT5qLWHD7PHqOEaKXDRKCoA2JMPXtk
WpEp6gRSl1WRzOSDYy/kczMCIol7zGm3fUfuURYQG1NEncB1hk7zTQ9wSHKzDDgH
n78dieg0nY+n8NnvKGJAL4EvzrSqfZ4zcvN2odCNSVzMfAQXaWLLhE7fuZek+NfY
IAS3x+/EzmiKtNeK/0kM
=waom
-----END PGP SIGNATURE-----
--nextPart4741153.VGaV7FWRE0--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5815854.WJiA8b3P58>