From owner-freebsd-ipfw@freebsd.org Thu Jul 7 08:43:10 2016 Return-Path: Delivered-To: freebsd-ipfw@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8EA74B76B4B for ; Thu, 7 Jul 2016 08:43:10 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 642E61F04 for ; Thu, 7 Jul 2016 08:43:10 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id u678h5Fi040656 for ; Thu, 7 Jul 2016 08:43:10 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-ipfw@FreeBSD.org Subject: [Bug 210408] Problem with outgoing traffic using ipfw and kernel nat originated from local address Date: Thu, 07 Jul 2016 08:43:06 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 10.2-RELEASE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: smithi@nimnet.asn.au X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-ipfw@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Jul 2016 08:43:10 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D210408 --- Comment #3 from smithi@nimnet.asn.au --- (In reply to Mark Felder from comment #2) Offhand I can think of three places that could be done: 1) /sbin/ipfw (userland) a) when NAT is configured, eg ipfw nat 123 config [ip address | if iface] .= .. b) when NAT would be first invoked, eg ipfw add [ruleno] nat 123 [condition= /s] 2) /sys/netpfil/ipfw/ip_fw2.c (kernel) when NAT is first actually invoked on a packet on the NAT interface. 3) /sys/netinet/libalias (kernel) (or from userland for natd(8)) on first use of an interface, ie (only) on the first packet processed. (1a) seems unlikely, as 'ip address' may not map to an iface on rule creati= on,=20 and a particular nat config may not even be used, or its rule not encounter= ed. (1b) perhaps, though its config needs consulting, and unless 'if iface' is= =20 specified it may not be straightforward to determine which interface - and= =20 we would only want TSO4 disabled on the NAT interface, not on any others. (1) is userland, so it might be more appropriate to 'call' /sbin/ifconfig f= rom=20 there, though again the address to interface mapping - from routing table/s= I=20 assume - may not already be in place upon ruleset creation. (2) and (3) are in-kernel. Perhaps the new libifconfig (ono) can be used fr= om=20 there, but I've only seen that go by in freebsd-net in passing. This would= =20 require testing for TSO4 being on, then setting it off (-tso or -tso4). Separately, /sbin/ipfw should probably insist on (or change to) 'ipv4' rath= er=20 than 'ip' or 'all' on nat rules, to guard against passing libalias(3) any= =20 ipv6 packets, another potential foot-shot. Just a few thought-bubbles, FWIW .. Ian --=20 You are receiving this mail because: You are the assignee for the bug.=