Date: Wed, 14 Dec 2005 12:44:46 GMT From: Denis Grinchuk <den2208@yandex.ru> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/90386: pfctl -s labels don't count bytes if labeled rule was NATted Message-ID: <200512141244.jBECikxH074480@www.freebsd.org> Resent-Message-ID: <200512141250.jBECo3xd063306@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 90386
>Category: misc
>Synopsis: pfctl -s labels don't count bytes if labeled rule was NATted
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Dec 14 12:50:02 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Denis Grinchuk
>Release: 5.4
>Organization:
-
>Environment:
FreeBSD free54.newintech.com. 5.4-RELEASE FreeBSD 5.4-RELEASE #0: Mon Nov 7 15:41:11 MSK 2005 root@free53.newintech.com.:/usr/src/sys/i386/compile/mykernel2 i386
>Description:
My machine is firewall and proxy-server. I need to count forwarding traffic from Internet (inbound only). Firewall - pf with nat (I have one real IP).Counter based on pf labels. NAT working on extenal interface like this (I simplify):
nat on $ext_if from $INT_NET to any -> $EXT_IP
pass out on $ext_if from $EXT_IP to any
pass in on $ext_if from any to $EXT_IP label "$dstaddr:external"
pass in on $int_if from $INT_NET to !<private>
pass out on $int_if from !<private> to $INT_NET label "$dstaddr:internal"
Counters at internal interface working well, but external show zero bytes:
#pfctl -s labels
192.168.0.0/24:internal 111 10 10000
1.2.3.4:extenal 111 0 0
I.e. hits was, but bytes wasn't counted for nat'ted backward packets.
Sorry for my English. Thank you for FreeBSD!
>How-To-Repeat:
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200512141244.jBECikxH074480>