From owner-freebsd-pf@FreeBSD.ORG Thu Oct 23 18:36:59 2014 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D1647B26 for ; Thu, 23 Oct 2014 18:36:59 +0000 (UTC) Received: from mail-lb0-x233.google.com (mail-lb0-x233.google.com [IPv6:2a00:1450:4010:c04::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 59EAED20 for ; Thu, 23 Oct 2014 18:36:59 +0000 (UTC) Received: by mail-lb0-f179.google.com with SMTP id l4so1323459lbv.24 for ; Thu, 23 Oct 2014 11:36:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=GTv7USE8E5HYVpmxXcxIOvKJUi9cXsD+3aG921S8D20=; b=CM+rowSCmwseZXVh7no29rPUrHcs5MsG15EE6cP+HhjJidSUeBvZT7tVQxuq4XB/L9 OSlcYCvVkRL+CJyid+ynem6c7BloWVAKe7qanN61NOrdUdIbqYZZCsxi+HD16D5X2eiX ow8BAmfHv3ygdZX1vnOk4OFaA5A9bWu2qKNqQXSyPJTwvYD14CuLWPj0wrHWyrGtn18z uANu57HCArMhprYOv7jvCHm1LPMkjbxSmVx6qhNHnnBeb1UQsRAMTeoknl4/YKGR0QHH n0WSFzKt9FWt7OAmWJXi697w3u1qFg53PMHRhRgDo2sbWXHngZib3V7bsn2gpyaaWTeN cuFQ== MIME-Version: 1.0 X-Received: by 10.112.85.138 with SMTP id h10mr6989555lbz.33.1414089417170; Thu, 23 Oct 2014 11:36:57 -0700 (PDT) Received: by 10.153.8.137 with HTTP; Thu, 23 Oct 2014 11:36:57 -0700 (PDT) In-Reply-To: References: Date: Thu, 23 Oct 2014 21:36:57 +0300 Message-ID: Subject: Re: SynProxy had a trouble when located front of a router device From: Tugrul Erdogan To: freebsd-pf@freebsd.org Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Oct 2014 18:36:59 -0000 Update: The topololgy has been redrawed below: | Atacker | <-> | FreeBSD | <-> | Router | <-> | Victim | Thanks, PS: Although connections lost by pf synproxy, the pings (form attacker to victim) can succesfully returns. On Thu, Oct 23, 2014 at 9:25 PM, Tugrul Erdogan wrote: > Hi, > > I have a trouble at pf synproxy state handshak=C4=B1ng mechanism. I have = been > using pf for years, but first time I have a router at the backpane of > topology. The schema of my topology given below: > > --------------------- --------------------------- > ------------------- ---------------------- > > Attacker <----------> FreeBSD(Test) > <-----------> Router <----> Victim > > ------------------- --------------------------- > ----------------- ------------------- > > I am trying to connect from attacker to the victim from port 80. Without > synproxy rule I have successfully conneting. Whenever I activate synproxy > state, the client(attacker) side handshaking completing (the outer > interface of FreeBSD device) > > 21:09:53.531421 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [S], seq > 1458776780, win 5840, options [mss 1460,sackOK,TS val 1336836512 ecr > 0,nop,wscale 7], length 0 > 21:09:53.531494 IP AA.BB.189.100.80 > AA.BB.183.93.51510: Flags [S.], seq > 2093170245, ack 1458776781, win 0, options [mss 1460], length 0 > 21:09:53.531524 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ack > 1, win 5840, length 0 > 21:09:56.533680 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ack > 1, win 5840, length 0 > 21:10:02.532255 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ack > 1, win 5840, length 0 > > after that the "pfct -vvss" showing: > > ix1 tcp AA.BB..183.93:51513 -> AA.BB..189.100:80 PROXY:DST > > and there is no package at inner interface of FreeBSD device at the resul= t > of tcpdump. After some seconds FreeBSD generates RST package both side. > (There is no handshake SYN or ACK packages generated by pf synproxy at th= e > inner interface) > > I think that the problem is about the router beacuse I had had successful > connections before the router device. When I turn off the synproxy or add > "keep state" instead of "synproxy state" I can successfully connecting. > > I want to take your opinions about why the handshake packages could not b= e > generate by pf synproxy? > > Regards, > Tugrul > >