Article View: bit.listserv.openbsd-pf
Article #84Re: nat-to and route-to specified in a single rule
From: Bojidara Marinchovska
Date: Tue, 07 Jun 2011 12:44
Date: Tue, 07 Jun 2011 12:44
252 lines
13431 bytes
13431 bytes
This is a multi-part message in MIME format.
--------------010909050008020804050401
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Hello,
pass in on $int_if from $network nat-to $ext_if is different from
pass out on $ext_if from $network nat-to $ext_if
Also from pf.conf(5)
nat-to is usually applied outbound. If applied inbound,
nat-to
to a local IP address is not supported.
On 06/06/11 11:05, Rob Sessink wrote:
>
> Hello,
>
> In a multi-homed setup I am trying to routeout packets over the
> secondary interface on which also NAT is done.
>
> The environment consists of a OpenBSD 4.9 Firewall with 3 em
> interfaces, connected to 2 DSL providers
>
> em0: internal interface
>
> em1: first DSL
>
> em2: second DSL
>
> I did dome testing with the understanding ruleset, where I have
> specified a nat-to and route-to statement in a single rule
>
> ########### rules ###########
>
> pass in log on em0 from 192.168.1.118 nat-to (e2gress:0) route-to
> (em2 80.100.x.x)
>
> pass out log on em2
>
> ########### states ###########
>
> all icmp 74.125.77.104:8 <- 80.100.x.x:54000
> (192.168.1.118:9035) 0:0
>
> all icmp 80.100.x.x:54000 -> 74.125.77.104:8 0:0
>
> This setup somewhat works. When pinging an upstream host, the packets
> get send out over the secondary interface, but the first packet is
> always dropped!
>
> According to the pf.conf man page this rule specification is possible.
> My question is this kind of rule specification allowed and intended to
> be working in PF?
>
> When splitting the nat-to / route-to statement in the ruleset
> everything works fine.
>
> ########### rules ###########
>
> pass in log on em0 from 192.168.1.118 route-to (em2 80.100.x.x)
>
> pass out log on em2 from 192.168.1.118 nat-to (em2:0)
>
> ########### states ###########
>
> all icmp 74.125.77.104:8 <- 192.168.1.118:8779 0:0
>
> all icmp 80.100.x.x:9676 (192.168.1.118:8779) -> 74.125.77.104:8 0:0
>
> Regards Rob
>
--------------010909050008020804050401
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hello,<br>
<br>
pass in on $int_if from $network nat-to $ext_if is different from<br>
pass out on $ext_if from $network nat-to $ext_if<br>
<br>
<br>
Also from pf.conf(5)<br>
<br>
nat-to is usually applied outbound. If applied
inbound, nat-to<br>
to a local IP address is not supported.<br>
<br>
<br>
<br>
<br>
On 06/06/11 11:05, Rob Sessink wrote:
<blockquote
cite="mid:5A7F701214D1B0498A66980564DF31230B89C52C@tbg-vms.tbg.lan"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="MS Exchange Server version
6.5.7654.12">
<title>nat-to and route-to specified in a single rule</title>
<!-- Converted from text/rtf format -->
<p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
lang="en-us"><font face="Calibri" size="2">Hello,</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">In a
multi-homed setup I am trying to route</font></span><span
lang="nl"></span><span lang="nl"></span><span lang="en-us"><font
face="Calibri" size="2"> out packets over the secondary
interface on which also NAT is done. </font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">The
environment consists of a OpenBSD 4.9 Firewall with 3 em
interfaces, connected to 2 DSL providers</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">em0:
internal interface</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">em1:
first DSL </font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">em2:
second DSL</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">I
did dome testing with the understanding ruleset, where I
have specified a nat-to and route-to statement in a single
rule</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">###########
rules ###########</font></span></p>
<p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
lang="en-us"><font face="Calibri" size="2">pass in log on em0
from 192.168.1.118 nat-to (e2gress:0) route-to (em2 80.1</font></span><span
lang="nl"></span><span lang="nl"></span><span lang="en-us"><font
face="Calibri" size="2">00</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">)</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">pass
out log on em2</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">###########
states ###########</font></span></p>
<p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
lang="en-us"><font face="Calibri" size="2">all icmp
74.125.77.104:8 <- 80.1</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">00</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">:54000 (192.168.1.118:9035) 0:0</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">all
icmp 80.1</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">00</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">:54000 -> 74.125.77.104:8 0:0</font></span><span
lang="nl"></span><span lang="nl"></span><span lang="en-us"></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">This
setup somewhat works. When pinging an upstream host, the
packets get send out over the secondary interface, but the
first packet is always dropped! </font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">According
to the pf.conf man page this rule specification is possible.
My question is this kind of rule specification allowed and
intended to be working in PF?</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2"> </font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">When
splitting the nat-to / route-to statement in the ruleset
everything works fine.</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">###########
rules ###########</font></span></p>
<p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
lang="en-us"><font face="Calibri" size="2">pass in log on em0
from 192.168.1.118 route-to (em2 80.1</font></span><span
lang="nl"></span><span lang="nl"></span><span lang="en-us"><font
face="Calibri" size="2">00</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">)</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">pass
out log on em2 from 192.168.1.118 nat-to (em2:0)</font></span><span
lang="nl"></span><span lang="nl"></span><span lang="en-us"></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">###########
states ###########</font></span></p>
<p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
lang="en-us"><font face="Calibri" size="2">all icmp
74.125.77.104:8 <- 192.168.1.118:8779 0:0</font></span></p>
<p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">all
icmp 80.1</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">00</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">.</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">x</font></span><span lang="nl"></span><span
lang="nl"></span><span lang="en-us"><font face="Calibri"
size="2">:9676 (192.168.1.118:8779) ->
74.125.77.104:8 0:0</font></span></p>
<p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
lang="en-us"></span></p>
<p dir="LTR"><span lang="en-us"> <font face="Calibri"
size="2">Regards Rob </font></span></p>
<p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
lang="nl"></span></p>
</blockquote>
<br>
</body>
</html>
--------------010909050008020804050401--
Technical Details
Message-ID:
<4DEE15E2.7060900@bobi.gateit.net>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrnReferences:
<5A7F701214D1B0498A66980564DF31230B89C52C@tbg-vms.tbg.lan>Show Full Headers
Complete Article Headers
X-Google-Thread: ff4ef,4e0555ec631c7476 X-Google-NewGroupId: yes X-Google-Attributes: gidbffa70e3,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn From: quintessence@bobi.gateit.net (Bojidara Marinchovska) Newsgroups: bit.listserv.openbsd-pf Subject: Re: nat-to and route-to specified in a single rule Date: 7 Jun 2011 05:44:15 -0700 Organization: None Lines: 252 Message-ID: <4DEE15E2.7060900@bobi.gateit.net> References: <5A7F701214D1B0498A66980564DF31230B89C52C@tbg-vms.tbg.lan> NNTP-Posting-Host: [192.168.1.247] Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="------------010909050008020804050401" NNTP-Posting-Date: 7 Jun 2011 12:44:16 GMT