From owner-freebsd-pf@FreeBSD.ORG Wed Oct 29 12:04:40 2014 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 56E44438 for ; Wed, 29 Oct 2014 12:04:40 +0000 (UTC) Received: from mail-la0-x231.google.com (mail-la0-x231.google.com [IPv6:2a00:1450:4010:c03::231]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id CCB75E03 for ; Wed, 29 Oct 2014 12:04:39 +0000 (UTC) Received: by mail-la0-f49.google.com with SMTP id ge10so2335101lab.22 for ; Wed, 29 Oct 2014 05:04:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type:content-transfer-encoding; bh=0JMFeKtyRvZDB7lH5RZanq/PZMxgscU4bebJMDPmdbs=; b=E3i2Yt9Zxrda8ceu4Qlvj/PlQIhchBWofWMWd2ACfPYSk0WcfjLHbzM47SxZ1CFylX XGEHc/wiKUXKXywwUdfViE+Pew1m4r/BFmhpKLQjAvsGm05/L/zK4FEQHnYTxWG+qOkf fqxHjJT4k8NKmFPLkr6CIAIHH+rBmg421c1UUdYHM1cY7siKgkbEnd84QgpS9GKZnDGB vv2/DDGK3AWpC2oxI3beTbdrZ3rh3NKlR9PSjUWVIqlOOmDr7QFcEbn95DeSqDLFFA2o HBvisGXx8ctAipvmEUTm4AfRvV4uikQOV3/3zlbxI+4WLo1Miukrk/pRTOjg7SU6l6F2 rBCw== X-Received: by 10.152.8.100 with SMTP id q4mr10697078laa.48.1414584277438; Wed, 29 Oct 2014 05:04:37 -0700 (PDT) MIME-Version: 1.0 Received: by 10.112.48.133 with HTTP; Wed, 29 Oct 2014 05:04:17 -0700 (PDT) In-Reply-To: References: From: Oguz Yilmaz Date: Wed, 29 Oct 2014 14:04:17 +0200 Message-ID: Subject: Re: SynProxy had a trouble when located front of a router device To: freebsd-pf@freebsd.org Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 12:04:40 -0000 Hello, Does pf synproxy support synproxying when internal side is 8021q VLAN? Best Regards, -- Oguz YILMAZ On Fri, Oct 24, 2014 at 1:52 PM, Tugrul Erdogan wrote: > I have important founding. I think it is about VLAN between FreeBSD-Route= r > in diagram. > > While Attacker-FreeBSD connection is normal IP connection, FreeBSD-Router > connection was tagged VLAN 159. > While FreeBSD-Router connection is VLAN based, synproxy rule State > Creations value increase, synproxy sends ACKS to the Attacker. > However synproxy replay with original server does not working ( The routi= ng > rule counter on os routing table which redirect packets to FreeBSD-Router > side is increasing but the packet can not be created ). > When I change FreeBSD-Router connection to normal IP connection without > VLAN, it starts to working. > > What can be the problem and solution? > > > > > On Thu, Oct 23, 2014 at 9:36 PM, Tugrul Erdogan > wrote: > >> Update: >> >> The topololgy has been redrawed below: >> >> >> | Atacker | <-> | FreeBSD | <-> | Router | <-> | Victim | >> >> >> Thanks, >> >> >> PS: Although connections lost by pf synproxy, the pings (form attacker t= o >> victim) can succesfully returns. >> >> >> >> >> On Thu, Oct 23, 2014 at 9:25 PM, Tugrul Erdogan < >> h.tugrul.erdogan@gmail.com> wrote: >> >>> Hi, >>> >>> I have a trouble at pf synproxy state handshak=C4=B1ng mechanism. I hav= e been >>> using pf for years, but first time I have a router at the backpane of >>> topology. The schema of my topology given below: >>> >>> --------------------- --------------------------= - >>> ------------------- ---------------------- >>> >>> Attacker <----------> FreeBSD(Test) >>> <-----------> Router <----> Victim >>> >>> ------------------- --------------------------= - >>> ----------------- ------------------- >>> >>> I am trying to connect from attacker to the victim from port 80. Withou= t >>> synproxy rule I have successfully conneting. Whenever I activate synpro= xy >>> state, the client(attacker) side handshaking completing (the outer >>> interface of FreeBSD device) >>> >>> 21:09:53.531421 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [S], se= q >>> 1458776780, win 5840, options [mss 1460,sackOK,TS val 1336836512 ecr >>> 0,nop,wscale 7], length 0 >>> 21:09:53.531494 IP AA.BB.189.100.80 > AA.BB.183.93.51510: Flags [S.], s= eq >>> 2093170245, ack 1458776781, win 0, options [mss 1460], length 0 >>> 21:09:53.531524 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ac= k >>> 1, win 5840, length 0 >>> 21:09:56.533680 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ac= k >>> 1, win 5840, length 0 >>> 21:10:02.532255 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ac= k >>> 1, win 5840, length 0 >>> >>> after that the "pfct -vvss" showing: >>> >>> ix1 tcp AA.BB..183.93:51513 -> AA.BB..189.100:80 PROXY:DST >>> >>> and there is no package at inner interface of FreeBSD device at the >>> result of tcpdump. After some seconds FreeBSD generates RST package bot= h >>> side. (There is no handshake SYN or ACK packages generated by pf synpro= xy >>> at the inner interface) >>> >>> I think that the problem is about the router beacuse I had had successf= ul >>> connections before the router device. When I turn off the synproxy or a= dd >>> "keep state" instead of "synproxy state" I can successfully connecting. >>> >>> I want to take your opinions about why the handshake packages could not >>> be generate by pf synproxy? >>> >>> Regards, >>> Tugrul >>> >>> >> > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"