Re: forwarding loop

Article View: bit.listserv.openbsd-pf

Article #159

Back to bit.listserv.openbsd-pf Previous Next

#159

From: Daniel Hartmeier
Date: Wed, 16 Jan 2013 13:33

41 lines
2439 bytes

On Wed, Jan 16, 2013 at 10:19:45AM +0100, Leslie Jensen wrote:

> The squid access.log says tcp_miss which should mean that the
> website has not replied.
> 
> The browser shows the squid access denied screen.
> 
> I cannot see any denied packets with tcpdump.
> 
> Commenting out the rdr rule gives direct access but I would like to
> get the use of squid back again.
> 
> I would appreciate further suggestions because at the moment I'm stuck!

Standard debugging procedure, then:

On the firewall, run the following

  fw# tcpdump -nvpi bge0 host 172.18.0.1
  fw# tcpdump -nvpi xl0 tcp port 80
  fw# tcpdump -nvvveeepi pflog0

Then initiate a single connection attempt from the proxy, like with

  proxy# nc -v www.openbsd.org 80

and watch the output of the tcpdumps.

What do you expect to see?

  1) TCP SYN from 172.18.0.1 to 129.128.5.194:80 on bge0
  2) TCP SYN from $ext_if to 129.128.5.194:80 on xl0
  3) TCP SYN+ACK from 129.128.5.194:80 to $ext_if on xl0
  4) TCP SYN+ACK from 129.128.5.194:80 to 172.18.0.1 on bge0
  5) nothing on pflog0 (except 'pass' messages)

What do you see instead?

If you see block messages on pflog0, re-post your current ruleset.

Daniel

Technical Details

Message-ID: <20130116095656.GA11866@insomnia.benzedrine.cx>

Path:

arc1-ca.pugleaf.net!6ni58pbd.1!nntp.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn

References:

<50F10ACD.9090605@eskk.nu> <20130114095023.GC8895@insomnia.benzedrine.cx> <50F42B02.70405@eskk.nu> <20130115101033.GA2410@insomnia.benzedrine.cx> <50F53466.1010803@eskk.nu> <20130115110146.GB2410@insomnia.benzedrine.cx> <50F53951.4080505@eskk.nu> <20130115114947.GC2410@insomnia.benzedrine.cx> <50F670B1.80005@eskk.nu>

Show Full Headers

Complete Article Headers

X-Google-Thread: ff4ef,65dda175aebfa248
X-Google-NewGroupId: yes
X-Google-Attributes: gidbffa70e3,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
X-Received: by 10.68.197.201 with SMTP id iw9mr123971pbc.6.1358343198536;
        Wed, 16 Jan 2013 05:33:18 -0800 (PST)
Path: arc1-ca.pugleaf.net!6ni58pbd.1!nntp.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: daniel@benzedrine.cx (Daniel Hartmeier)
Newsgroups: bit.listserv.openbsd-pf
Subject: Re: forwarding loop
Date: 16 Jan 2013 05:33:17 -0800
Organization: None
Lines: 41
Message-ID: <20130116095656.GA11866@insomnia.benzedrine.cx>
References: <50F10ACD.9090605@eskk.nu>
 <20130114095023.GC8895@insomnia.benzedrine.cx>
 <50F42B02.70405@eskk.nu>
 <20130115101033.GA2410@insomnia.benzedrine.cx>
 <50F53466.1010803@eskk.nu>
 <20130115110146.GB2410@insomnia.benzedrine.cx>
 <50F53951.4080505@eskk.nu>
 <20130115114947.GC2410@insomnia.benzedrine.cx>
 <50F670B1.80005@eskk.nu>
NNTP-Posting-Host: localhost.newsguy.com
Mime-Version: 1.0
NNTP-Posting-Date: 16 Jan 2013 13:33:18 GMT
X-Received-Bytes: 2065
Content-Type: text/plain; charset=us-ascii

Reply to Parent Message