Article View: bit.listserv.openbsd-pf
Article #85RE: nat-to and route-to specified in a single rule
From: Rob Sessink
Date: Tue, 07 Jun 2011 16:42
Date: Tue, 07 Jun 2011 16:42
442 lines
13875 bytes
13875 bytes
This is a multi-part message in MIME format.
------_=_NextPart_001_01CC2528.9C0684BD
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Hello,
=20
You're right, looking again at this rule, it is unwanted to do the NAT
on the inbound packets=20
of the internal interface when the firewall is connected to multiple
networks/interfaces.
=20
Thanks for the pointer to pf.conf(5). But what is meant with the
statement a 'local IP address' in this context?.=20
=20
Thx Rob
=20
=20
=20
=20
=20
=20
Van: Bojidara Marinchovska [mailto:quintessence@bobi.gateit.net]=20
Verzonden: dinsdag 7 juni 2011 14:13
Aan: Rob Sessink
CC: pf@benzedrine.cx
Onderwerp: Re: nat-to and route-to specified in a single rule
=20
Hello,
pass in on $int_if from $network nat-to $ext_if is different from
pass out on $ext_if from $network nat-to $ext_if
Also from pf.conf(5)
nat-to is usually applied outbound. If applied inbound,
nat-to
to a local IP address is not supported.
On 06/06/11 11:05, Rob Sessink wrote:=20
Hello,
In a multi-homed setup I am trying to route out packets over the
secondary interface on which also NAT is done.=20
The environment consists of a OpenBSD 4.9 Firewall with 3 em interfaces,
connected to 2 DSL providers
em0: internal interface
em1: first DSL=20
em2: second DSL
I did dome testing with the understanding ruleset, where I have
specified a nat-to and route-to statement in a single rule
########### rules ###########
pass in log on em0 from 192.168.1.118 nat-to (e2gress:0) route-to (em2
80.100.x.x)
pass out log on em2
########### states ###########
all icmp 74.125.77.104:8 <- 80.100.x.x:54000 (192.168.1.118:9035)
0:0
all icmp 80.100.x.x:54000 -> 74.125.77.104:8 0:0
This setup somewhat works. When pinging an upstream host, the packets
get send out over the secondary interface, but the first packet is
always dropped!=20
According to the pf.conf man page this rule specification is possible.
My question is this kind of rule specification allowed and intended to
be working in PF?
=20
When splitting the nat-to / route-to statement in the ruleset everything
works fine.
########### rules ###########
pass in log on em0 from 192.168.1.118 route-to (em2 80.100.x.x)
pass out log on em2 from 192.168.1.118 nat-to (em2:0)
########### states ###########
all icmp 74.125.77.104:8 <- 192.168.1.118:8779 0:0
all icmp 80.100.x.x:9676 (192.168.1.118:8779) -> 74.125.77.104:8
0:0
Regards Rob=20
=20
------_=_NextPart_001_01CC2528.9C0684BD
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<title>nat-to and route-to specified in a single rule</title>
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
span.E-mailStijl18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=3Dwhite lang=3DNL link=3Dblue vlink=3Dpurple>
<div class=3DSection1>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Hello,<o:p></o:p></span></p>
<p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>You’re right, looking again at this rule, it is =
unwanted
to do the NAT on the inbound packets <o:p></o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>of the internal interface when the firewall is connected =
to multiple
networks/interfaces.<o:p></o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Thanks for the pointer to pf.conf(5). But what is meant =
with the
statement a ‘local IP address’ in this context?. =
<o:p></o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=3DMsoNormal style=3D'text-indent:35.4pt'><span lang=3DEN-US
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Thx
Rob<o:p></o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt =
0cm 0cm 0cm'>
<p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:
"Tahoma","sans-serif";color:windowtext'>Van:</span></b><span =
lang=3DEN-US
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowt=
ext'>
Bojidara Marinchovska [mailto:quintessence@bobi.gateit.net] <br>
<b>Verzonden:</b> dinsdag 7 juni 2011 14:13<br>
<b>Aan:</b> Rob Sessink<br>
<b>CC:</b> pf@benzedrine.cx<br>
<b>Onderwerp:</b> Re: nat-to and route-to specified in a single =
rule<o:p></o:p></span></p>
</div>
</div>
<p class=3DMsoNormal><span lang=3DEN-US><o:p> </o:p></span></p>
<p class=3DMsoNormal>Hello,<br>
<br>
pass in on $int_if from $network nat-to $ext_if is different from<br>
pass out on $ext_if from $network nat-to $ext_if<br>
<br>
<br>
Also from pf.conf(5)<br>
<br>
&=
nbsp;
nat-to is usually applied outbound. If applied inbound, nat-to<br>
&=
nbsp;
to a local IP address is not supported.<br>
<br>
<br>
<br>
<br>
On 06/06/11 11:05, Rob Sessink wrote: <o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>Hello,</spa=
n><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>In
a multi-homed setup I am trying to route out packets over the secondary =
interface
on which also NAT is done. </span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>The
environment consists of a OpenBSD 4.9 Firewall with 3 em interfaces, =
connected
to 2 DSL providers</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>em0:
internal interface</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>em1:
first DSL </span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>em2:
second DSL</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>I
did dome testing with the understanding ruleset, where I have specified =
a
nat-to and route-to statement in a single rule</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>###########=
rules ###########</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>pass
in log on em0 from 192.168.1.118 nat-to (e2gress:0) route-to (em2
80.100.x.x)</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>pass
out log on em2</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>###########=
states ###########</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>all
icmp 74.125.77.104:8 <- 80.100.x.x:54000
(192.168.1.118:9035) =
0:0</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>all
icmp 80.100.x.x:54000 -> =
74.125.77.104:8
0:0</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>This
setup somewhat works. When pinging an upstream host, the packets get =
send out
over the secondary interface, but the first packet is always dropped! =
</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>According
to the pf.conf man page this rule specification is possible. My question =
is
this kind of rule specification allowed and intended to be working in =
PF?</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'> </spa=
n><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>When
splitting the nat-to / route-to statement in the ruleset everything =
works fine.</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>###########=
rules ###########</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>pass
in log on em0 from 192.168.1.118 route-to (em2 =
80.100.x.x)</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>pass
out log on em2 from 192.168.1.118 nat-to (em2:0)</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>###########=
states ###########</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>all
icmp 74.125.77.104:8 <-
192.168.1.118:8779 =
0:0</span><o:p></o:p></p>
<p><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>all
icmp 80.100.x.x:9676 (192.168.1.118:8779) ->
74.125.77.104:8 =
0:0</span><o:p></o:p></p>
<p><span lang=3DEN-US> =
</span><span
lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Calibri","sans-serif"'>Regards
Rob </span><o:p></o:p></p>
<p class=3DMsoNormal><o:p> </o:p></p>
</div>
</body>
</html>
------_=_NextPart_001_01CC2528.9C0684BD--
Technical Details
Message-ID:
<5A7F701214D1B0498A66980564DF31230B8D37F8@tbg-vms.tbg.lan>Path:
arc1-ca.pugleaf.net!g2news2.google.com!news2.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrnReferences:
<4DEE15E2.7060900@bobi.gateit.net>Show Full Headers
Complete Article Headers
X-Google-Thread: ff4ef,4e0555ec631c7476 X-Google-NewGroupId: yes X-Google-Attributes: gidbffa70e3,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news2.google.com!news2.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn From: rsessink@tenbrinke.com (Rob Sessink) Newsgroups: bit.listserv.openbsd-pf Subject: RE: nat-to and route-to specified in a single rule Date: 7 Jun 2011 09:42:09 -0700 Organization: None Lines: 442 Message-ID: <5A7F701214D1B0498A66980564DF31230B8D37F8@tbg-vms.tbg.lan> References: <4DEE15E2.7060900@bobi.gateit.net> NNTP-Posting-Host: mail.tenbrinke.com Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CC2528.9C0684BD" NNTP-Posting-Date: 7 Jun 2011 16:42:10 GMT