🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Thread View: bit.listserv.openbsd-pf
3 messages
3 total messages Started by Rob Sessink Mon, 06 Jun 2011 08:45
nat-to and route-to specified in a single rule
#83
Author: Rob Sessink
Date: Mon, 06 Jun 2011 08:45
237 lines
11372 bytes
This is a multi-part message in MIME format.

------_=_NextPart_001_01CC2420.8D1FD2CD
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hello,

In a multi-homed setup I am trying to route out packets over the
secondary interface on which also NAT is done.=20
The environment consists of a OpenBSD 4.9 Firewall with 3 em interfaces,
connected to 2 DSL providers

em0: internal interface
em1: first DSL=20
em2: second DSL

I did dome testing with the understanding ruleset, where I have
specified a nat-to and route-to statement in a single rule
########### rules ###########
pass in  log on em0 from 192.168.1.118 nat-to (e2gress:0) route-to (em2
80.100.x.x)
pass out log on em2

########### states ###########
all icmp 74.125.77.104:8 <- 80.100.x.x:54000 (192.168.1.118:9035)
0:0
all icmp 80.100.x.x:54000 -> 74.125.77.104:8       0:0

This setup somewhat works. When pinging an upstream host, the packets
get send out over the secondary interface, but the first packet is
always dropped!=20
According to the pf.conf man page this rule specification is possible.
My question is this kind of rule specification allowed and intended to
be working in PF?
=20
When splitting the nat-to / route-to statement in the ruleset everything
works fine.
########### rules ###########
pass in  log on em0 from 192.168.1.118 route-to (em2 80.100.x.x)
pass out log on em2 from 192.168.1.118 nat-to (em2:0)

########### states ###########
all icmp 74.125.77.104:8 <- 192.168.1.118:8779       0:0
all icmp 80.100.x.x:9676 (192.168.1.118:8779) -> 74.125.77.104:8
0:0

	Regards Rob=20


------_=_NextPart_001_01CC2420.8D1FD2CD
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.5.7654.12">
<TITLE>nat-to and route-to specified in a single rule</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->

<P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">Hello,</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">In a =
multi-homed setup I am trying to route</FONT></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT =
SIZE=3D2 FACE=3D"Calibri"> out packets over the secondary interface on =
which also NAT is done. </FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">The =
environment consists of a OpenBSD 4.9 Firewall with 3 em interfaces, =
connected to 2 DSL providers</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">em0: =
internal interface</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">em1: =
first DSL </FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">em2: =
second DSL</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">I did =
dome testing with the understanding ruleset, where I have specified a =
nat-to and route-to statement in a single rule</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">########### rules ###########</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">pass in&nbsp; log on em0 =
from 192.168.1.118 nat-to (e2gress:0) route-to (em2 =
80.1</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">)</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">pass =
out log on em2</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">########### states ###########</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">all icmp 74.125.77.104:8 =
&lt;- 80.1</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">:54000 =
(192.168.1.118:9035)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
0:0</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">all =
icmp 80.1</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">:54000 -&gt; =
74.125.77.104:8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
0:0</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"en-us"></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">This =
setup somewhat works. When pinging an upstream host, the packets get =
send out over the secondary interface, but the first packet is always =
dropped! </FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">According to the pf.conf man page this rule =
specification is possible. My question is this kind of rule =
specification allowed and intended to be working in =
PF?</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">&nbsp;</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">When =
splitting the nat-to / route-to statement in the ruleset everything =
works fine.</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">########### rules ###########</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">pass in&nbsp; log on em0 =
from 192.168.1.118 route-to (em2 80.1</FONT></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT =
SIZE=3D2 FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">)</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">pass =
out log on em2 from 192.168.1.118 nat-to (em2:0)</FONT></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"en-us"></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">########### states ###########</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">all icmp 74.125.77.104:8 =
&lt;- 192.168.1.118:8779&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
0:0</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Calibri">all =
icmp 80.1</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">00</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">.</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">x</FONT></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN><SPAN LANG=3D"en-us"><FONT SIZE=3D2 =
FACE=3D"Calibri">:9676 (192.168.1.118:8779) -&gt; =
74.125.77.104:8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
0:0</FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"en-us"></SPAN></P>

<P DIR=3DLTR><SPAN =
LANG=3D"en-us">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT SIZE=3D2 =
FACE=3D"Calibri">Regards Rob </FONT></SPAN></P>

<P DIR=3DLTR><SPAN LANG=3D"nl"></SPAN><SPAN LANG=3D"nl"></SPAN><SPAN =
LANG=3D"nl"></SPAN></P>

</BODY>
</HTML>
------_=_NextPart_001_01CC2420.8D1FD2CD--
Re: nat-to and route-to specified in a single rule
#84
Author: Bojidara Marinchovska
Date: Tue, 07 Jun 2011 12:44
252 lines
13431 bytes
This is a multi-part message in MIME format.
--------------010909050008020804050401
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hello,

pass in on $int_if from $network nat-to $ext_if is different from
pass out on $ext_if from $network nat-to $ext_if


Also from pf.conf(5)

                nat-to is usually applied outbound.  If applied inbound, 
nat-to
                to a local IP address is not supported.




On 06/06/11 11:05, Rob Sessink wrote:
>
> Hello,
>
> In a multi-homed setup I am trying to routeout packets over the 
> secondary interface on which also NAT is done.
>
> The environment consists of a OpenBSD 4.9 Firewall with 3 em 
> interfaces, connected to 2 DSL providers
>
> em0: internal interface
>
> em1: first DSL
>
> em2: second DSL
>
> I did dome testing with the understanding ruleset, where I have 
> specified a nat-to and route-to statement in a single rule
>
> ########### rules ###########
>
> pass in  log on em0 from 192.168.1.118 nat-to (e2gress:0) route-to 
> (em2 80.100.x.x)
>
> pass out log on em2
>
> ########### states ###########
>
> all icmp 74.125.77.104:8 <- 80.100.x.x:54000 
> (192.168.1.118:9035)       0:0
>
> all icmp 80.100.x.x:54000 -> 74.125.77.104:8       0:0
>
> This setup somewhat works. When pinging an upstream host, the packets 
> get send out over the secondary interface, but the first packet is 
> always dropped!
>
> According to the pf.conf man page this rule specification is possible. 
> My question is this kind of rule specification allowed and intended to 
> be working in PF?
>
> When splitting the nat-to / route-to statement in the ruleset 
> everything works fine.
>
> ########### rules ###########
>
> pass in  log on em0 from 192.168.1.118 route-to (em2 80.100.x.x)
>
> pass out log on em2 from 192.168.1.118 nat-to (em2:0)
>
> ########### states ###########
>
> all icmp 74.125.77.104:8 <- 192.168.1.118:8779       0:0
>
> all icmp 80.100.x.x:9676 (192.168.1.118:8779) -> 74.125.77.104:8       0:0
>
> Regards Rob
>


--------------010909050008020804050401
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#ffffff" text="#000000">
    Hello,<br>
    <br>
    pass in on $int_if from $network nat-to $ext_if is different from<br>
    pass out on $ext_if from $network nat-to $ext_if<br>
    <br>
    <br>
    Also from pf.conf(5)<br>
    <br>
    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; nat-to is usually applied outbound.&nbsp; If applied
    inbound, nat-to<br>
    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; to a local IP address is not supported.<br>
    <br>
    <br>
    <br>
    <br>
    On 06/06/11 11:05, Rob Sessink wrote:
    <blockquote
      cite="mid:5A7F701214D1B0498A66980564DF31230B89C52C@tbg-vms.tbg.lan"
      type="cite">
      <meta http-equiv="Content-Type" content="text/html;
        charset=ISO-8859-1">
      <meta name="Generator" content="MS Exchange Server version
        6.5.7654.12">
      <title>nat-to and route-to specified in a single rule</title>
      <!-- Converted from text/rtf format -->
      <p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
          lang="en-us"><font face="Calibri" size="2">Hello,</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">In a
            multi-homed setup I am trying to route</font></span><span
          lang="nl"></span><span lang="nl"></span><span lang="en-us"><font
            face="Calibri" size="2"> out packets over the secondary
            interface on which also NAT is done. </font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">The
            environment consists of a OpenBSD 4.9 Firewall with 3 em
            interfaces, connected to 2 DSL providers</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">em0:
            internal interface</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">em1:
            first DSL </font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">em2:
            second DSL</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">I
            did dome testing with the understanding ruleset, where I
            have specified a nat-to and route-to statement in a single
            rule</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">###########
            rules ###########</font></span></p>
      <p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
          lang="en-us"><font face="Calibri" size="2">pass in&nbsp; log on em0
            from 192.168.1.118 nat-to (e2gress:0) route-to (em2 80.1</font></span><span
          lang="nl"></span><span lang="nl"></span><span lang="en-us"><font
            face="Calibri" size="2">00</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">)</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">pass
            out log on em2</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">###########
            states ###########</font></span></p>
      <p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
          lang="en-us"><font face="Calibri" size="2">all icmp
            74.125.77.104:8 &lt;- 80.1</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">00</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">:54000 (192.168.1.118:9035)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0:0</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">all
            icmp 80.1</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">00</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">:54000 -&gt; 74.125.77.104:8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0:0</font></span><span
          lang="nl"></span><span lang="nl"></span><span lang="en-us"></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">This
            setup somewhat works. When pinging an upstream host, the
            packets get send out over the secondary interface, but the
            first packet is always dropped! </font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">According
            to the pf.conf man page this rule specification is possible.
            My question is this kind of rule specification allowed and
            intended to be working in PF?</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">&nbsp;</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">When
            splitting the nat-to / route-to statement in the ruleset
            everything works fine.</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">###########
            rules ###########</font></span></p>
      <p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
          lang="en-us"><font face="Calibri" size="2">pass in&nbsp; log on em0
            from 192.168.1.118 route-to (em2 80.1</font></span><span
          lang="nl"></span><span lang="nl"></span><span lang="en-us"><font
            face="Calibri" size="2">00</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">)</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">pass
            out log on em2 from 192.168.1.118 nat-to (em2:0)</font></span><span
          lang="nl"></span><span lang="nl"></span><span lang="en-us"></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">###########
            states ###########</font></span></p>
      <p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
          lang="en-us"><font face="Calibri" size="2">all icmp
            74.125.77.104:8 &lt;- 192.168.1.118:8779&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0:0</font></span></p>
      <p dir="LTR"><span lang="en-us"><font face="Calibri" size="2">all
            icmp 80.1</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">00</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">.</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">x</font></span><span lang="nl"></span><span
          lang="nl"></span><span lang="en-us"><font face="Calibri"
            size="2">:9676 (192.168.1.118:8779) -&gt;
            74.125.77.104:8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0:0</font></span></p>
      <p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
          lang="en-us"></span></p>
      <p dir="LTR"><span lang="en-us">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font face="Calibri"
            size="2">Regards Rob </font></span></p>
      <p dir="LTR"><span lang="nl"></span><span lang="nl"></span><span
          lang="nl"></span></p>
    </blockquote>
    <br>
  </body>
</html>

--------------010909050008020804050401--
Re: nat-to and route-to specified in a single rule
#86
Author: Stuart Henderson
Date: Tue, 07 Jun 2011 17:13
9 lines
1356 bytes
On 2011/06/07 17:36, Rob Sessink wrote:
> You’re right, looking again at this rule, it is unwanted to do
> the NAT on the inbound packets of the internal interface when the
> firewall is connected to multiple networks/interfaces.
> 
> Thanks for the pointer to pf.conf(5). But what is meant with the
> statement a ‘local IP address’ in this context?.

An address on the local machine.
Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads