Article View: bit.listserv.openbsd-pf
Article #83nat-to and route-to specified in a single rule
From: Rob Sessink
Date: Mon, 06 Jun 2011 08:45
Date: Mon, 06 Jun 2011 08:45
237 lines
11372 bytes
11372 bytes
This is a multi-part message in MIME format. ------_=_NextPart_001_01CC2420.8D1FD2CD Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello, In a multi-homed setup I am trying to route out packets over the secondary interface on which also NAT is done.=20 The environment consists of a OpenBSD 4.9 Firewall with 3 em interfaces, connected to 2 DSL providers em0: internal interface em1: first DSL=20 em2: second DSL I did dome testing with the understanding ruleset, where I have specified a nat-to and route-to statement in a single rule ########### rules ########### pass in log on em0 from 192.168.1.118 nat-to (e2gress:0) route-to (em2 80.100.x.x) pass out log on em2 ########### states ########### all icmp 74.125.77.104:8 <- 80.100.x.x:54000 (192.168.1.118:9035) 0:0 all icmp 80.100.x.x:54000 -> 74.125.77.104:8 0:0 This setup somewhat works. When pinging an upstream host, the packets get send out over the secondary interface, but the first packet is always dropped!=20 According to the pf.conf man page this rule specification is possible. My question is this kind of rule specification allowed and intended to be working in PF? =20 When splitting the nat-to / route-to statement in the ruleset everything works fine. ########### rules ########### pass in log on em0 from 192.168.1.118 route-to (em2 80.100.x.x) pass out log on em2 from 192.168.1.118 nat-to (em2:0) ########### states ########### all icmp 74.125.77.104:8 <- 192.168.1.118:8779 0:0 all icmp 80.100.x.x:9676 (192.168.1.118:8779) -> 74.125.77.104:8 0:0 Regards Rob=20 ------_=_NextPart_001_01CC2420.8D1FD2CD Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 6.5.7654.12"> <TITLE>nat-to and route-to specified in a single rule</TITLE> </HEAD> <BODY> <!-- Converted from text/rtf format --> <P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">Hello,</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">In a = multi-homed setup I am trying to route</FONT></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT = SIZE=3D2 FACE=3D"Calibri"> out packets over the secondary interface on = which also NAT is done. </FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">The = environment consists of a OpenBSD 4.9 Firewall with 3 em interfaces, = connected to 2 DSL providers</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">em0: = internal interface</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">em1: = first DSL </FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">em2: = second DSL</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">I did = dome testing with the understanding ruleset, where I have specified a = nat-to and route-to statement in a single rule</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">########### rules ###########</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">pass in log on em0 = from 192.168.1.118 nat-to (e2gress:0) route-to (em2 = 80.1</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">)</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">pass = out log on em2</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">########### states ###########</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">all icmp 74.125.77.104:8 = <- 80.1</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">:54000 = (192.168.1.118:9035) = 0:0</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">all = icmp 80.1</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">:54000 -> = 74.125.77.104:8 = 0:0</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"en-us"></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">This = setup somewhat works. When pinging an upstream host, the packets get = send out over the secondary interface, but the first packet is always = dropped! </FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">According to the pf.conf man page this rule = specification is possible. My question is this kind of rule = specification allowed and intended to be working in = PF?</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri"> </FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">When = splitting the nat-to / route-to statement in the ruleset everything = works fine.</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">########### rules ###########</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">pass in log on em0 = from 192.168.1.118 route-to (em2 80.1</FONT></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT = SIZE=3D2 FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">)</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">pass = out log on em2 from 192.168.1.118 nat-to (em2:0)</FONT></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"en-us"></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">########### states ###########</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">all icmp 74.125.77.104:8 = <- 192.168.1.118:8779 = 0:0</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">all = icmp 80.1</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 = FACE=3D"Calibri">:9676 (192.168.1.118:8779) -> = 74.125.77.104:8 = 0:0</FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"en-us"></SPAN></P> <P DIR=3DLTR><SPAN = LANG=3D"en-us"> <FONT SIZE=3D2 = FACE=3D"Calibri">Regards Rob </FONT></SPAN></P> <P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN = LANG=3D"nl"></SPAN></P> </BODY> </HTML> ------_=_NextPart_001_01CC2420.8D1FD2CD--
Technical Details
Message-ID:
<5A7F701214D1B0498A66980564DF31230B89C52C@tbg-vms.tbg.lan>Path:
arc1-ca.pugleaf.net!g2news2.google.com!news2.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrnShow Full Headers
Complete Article Headers
X-Google-Thread: ff4ef,4e0555ec631c7476,start X-Google-NewGroupId: yes X-Google-Attributes: gidbffa70e3,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news2.google.com!news2.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn From: rsessink@tenbrinke.com (Rob Sessink) Newsgroups: bit.listserv.openbsd-pf Subject: nat-to and route-to specified in a single rule Date: 6 Jun 2011 01:45:05 -0700 Organization: None Lines: 237 Message-ID: <5A7F701214D1B0498A66980564DF31230B89C52C@tbg-vms.tbg.lan> NNTP-Posting-Host: mail.tenbrinke.com Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CC2420.8D1FD2CD" NNTP-Posting-Date: 6 Jun 2011 08:45:05 GMT