🚀 go-pugleaf

--000e0cd149e06a2ef704a9ff0853
Content-Type: text/plain; charset=UTF-8

Hi,
I am currently running OpenBSD 4.9 as a router/firewall for my work and so
far I have nearly a fully working config but there is something I cannot
manage to do :(

Here is my configuration:
The server has 1 physical interface, I added a gif interface to connect it
to a remote machine which is used to route most of the traffic, on this gif
interface I have incoming requests I want to pass through squid.

Here is my pf.conf fie (prettier version here:
https://gist.github.com/1131783 ):

    phys_if = "re0"

    c1_tunnel = "gif1001"
    c1_tunnel_dst = "95.140.15.38"
    c1_tunnel_src = "87.98.149.50"
    c1_escape = "87.98.154.179"

    set skip on lo0
    set block-policy drop

    # block any packet with no match
    block log all

    # allow our own services to work
    pass in on $phys_if proto tcp from any to $phys_if port { ssh } synproxy
state
    pass in on $phys_if inet proto icmp from any to $phys_if
    pass out on $phys_if label "system"

    # allow ipip traffic (gif interface)
    pass in on $phys_if from $c1_tunnel_dst to $c1_tunnel_src label
"c1_tunnel"
    pass out on $phys_if from $c1_tunnel_src to $c1_tunnel_dst label
"c1_tunnel"

    # tag incoming packets from the tunnel and from
    # the outside to the public ip address
    match in log(matches) on $c1_tunnel tag "c1"
    match in log(matches) on $phys_if from any to $c1_escape tag "c1"

    # Allow incoming packet to port 80 and redirect them to squid
    pass in log(matches, all) on $c1_tunnel proto tcp to port 80 \
      rdr-to 127.0.0.1 port 1001 \
      reply-to ($c1_tunnel 10.0.0.5) \
      tagged "c1" label "c1_proxied_traffic"



The result is that I cannot establish a tcp connection to port 80 for a
machine behing the gif tunnel, here is what tcpdump says on this machine (
tcpdump -s 0 -vlni <interface> port 80 ):

IP (tos 0x0, ttl  62, id 8175, offset 0, flags [DF], length: 60)
<client_address>.21746 > <web_address>.80: S [tcp sum ok]
3993732249:3993732249(0) win 65535 <mss 1380,nop,wscale 3,sackOK,timestamp
442132554 0>
IP (tos 0x0, ttl  64, id 59219, offset 0, flags [DF], length: 64)
<web_address>.80 > <client_address>.21746: S [tcp sum ok]
3332347257:3332347257(0) ack 3993732250 win 16384 <mss
1440,nop,nop,sackOK,nop,wscale 3,nop,nop,timestamp 2569862135 442132554>

IP (tos 0x0, ttl  62, id 8176, offset 0, flags [DF], length: 52)
<client_address>.21746 > <web_address>.80: . [tcp sum ok] ack 1 win 8208
<nop,nop,timestamp 442132595 2569862135>
IP (tos 0x0, ttl  62, id 8189, offset 0, flags [DF], length: 54)
<client_address>.21746 > <web_address>.80: P [tcp sum ok] 1:3(2) ack 1 win
8208 <nop,nop,timestamp 442134444 2569862135>
IP (tos 0x0, ttl  64, id 65354, offset 0, flags [DF], length: 58)
<web_address>.80 > <client_address>.21746: P [bad tcp cksum a676 (->a9cf)!]
1:7(6) ack 3 win 2052 <nop,nop,timestamp 2569862139 442134444>

IP (tos 0x0, ttl  62, id 8190, offset 0, flags [DF], length: 54)
<client_address>.21746 > <web_address>.80: P [tcp sum ok] 1:3(2) ack 1 win
8208 <nop,nop,timestamp 442134770 2569862135>
IP (tos 0x0, ttl  64, id 23274, offset 0, flags [DF], length: 52)
<web_address>.80 > <client_address>.21746: . [bad tcp cksum b6c8 (->ba21)!]
ack 3 win 2052 <nop,nop,timestamp 2569862139 442134770>

IP (tos 0x0, ttl  62, id 8194, offset 0, flags [DF], length: 54)
<client_address>.21746 > <web_address>.80: P [tcp sum ok] 1:3(2) ack 1 win
8208 <nop,nop,timestamp 442135222 2569862135>
IP (tos 0x0, ttl  64, id 4613, offset 0, flags [DF], length: 52)
<web_address>.80 > <client_address>.21746: . [bad tcp cksum b503 (->b85c)!]
ack 3 win 2052 <nop,nop,timestamp 2569862140 442135222>
IP (tos 0x0, ttl  62, id 8199, offset 0, flags [DF], length: 54)
<client_address>.21746 > <web_address>.80: P [tcp sum ok] 1:3(2) ack 1 win
8208 <nop,nop,timestamp 442135926 2569862135>
IP (tos 0x0, ttl  64, id 41419, offset 0, flags [DF], length: 52)
<web_address>.80 > <client_address>.21746: . [bad tcp cksum b241 (->b59a)!]
ack 3 win 2052 <nop,nop,timestamp 2569862142 442135926>

IP (tos 0x0, ttl  62, id 8205, offset 0, flags [DF], length: 52)
<client_address>.21746 > <web_address>.80: F [tcp sum ok] 3:3(0) ack 1 win
8208 <nop,nop,timestamp 442136662 2569862135>
IP (tos 0x0, ttl  62, id 8209, offset 0, flags [DF], length: 54)
<client_address>.21746 > <web_address>.80: FP [tcp sum ok] 1:3(2) ack 1 win
8208 <nop,nop,timestamp 442137134 2569862135>
IP (tos 0x0, ttl  64, id 43519, offset 0, flags [DF], length: 58)
<web_address>.80 > <client_address>.21746: P [bad tcp cksum 9bee (->9f47)!]
1:7(6) ack 3 win 2052 <nop,nop,timestamp 2569862145 442137134>


There is only one packet from the web server (which is in fact my server
since the request was redirected to squid ) which finds its way to the
client and after that all the checksum are wrong and I suppose the packets
are dropped since they never reach my client (which is curl). I tried to
figure out why the checksum could be wrong but I am now out of ideas...

I hope someone can help me on this.

--000e0cd149e06a2ef704a9ff0853
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi,<br>I am currently running OpenBSD 4.9 as a router/firewall for my work =
and so far I have nearly a fully working config but there is something I ca=
nnot manage to do :(<br><br>Here is my configuration:<br>The server has 1 p=
hysical interface, I added a gif interface to connect it to a remote machin=
e which is used to route most of the traffic, on this gif interface I have =
incoming requests I want to pass through squid.<br>

<br>Here is my pf.conf fie (prettier version here: <a href=3D"https://gist.=
github.com/1131783">https://gist.github.com/1131783</a> ): <br><br>=C2=A0=
=C2=A0=C2=A0 phys_if =3D &quot;re0&quot;<br><br>=C2=A0=C2=A0=C2=A0 c1_tunne=
l =3D &quot;gif1001&quot;<br>=C2=A0=C2=A0=C2=A0 c1_tunnel_dst =3D &quot;95.=
140.15.38&quot;<br>

=C2=A0=C2=A0=C2=A0 c1_tunnel_src =3D &quot;87.98.149.50&quot;<br>=C2=A0=C2=
=A0=C2=A0 c1_escape =3D &quot;87.98.154.179&quot;<br><br>=C2=A0=C2=A0=C2=A0=
 set skip on lo0<br>=C2=A0=C2=A0=C2=A0 set block-policy drop<br><br>=C2=A0=
=C2=A0=C2=A0 # block any packet with no match<br>=C2=A0=C2=A0=C2=A0 block l=
og all<br><br>=C2=A0=C2=A0=C2=A0 # allow our own services to work<br>

=C2=A0=C2=A0=C2=A0 pass in on $phys_if proto tcp from any to $phys_if port =
{ ssh } synproxy state<br>=C2=A0=C2=A0=C2=A0 pass in on $phys_if inet proto=
 icmp from any to $phys_if<br>=C2=A0=C2=A0=C2=A0 pass out on $phys_if label=
 &quot;system&quot;<br><br>=C2=A0=C2=A0=C2=A0 # allow ipip traffic (gif int=
erface)<br>

=C2=A0=C2=A0=C2=A0 pass in on $phys_if from $c1_tunnel_dst to $c1_tunnel_sr=
c label &quot;c1_tunnel&quot;<br>=C2=A0=C2=A0=C2=A0 pass out on $phys_if fr=
om $c1_tunnel_src to $c1_tunnel_dst label &quot;c1_tunnel&quot;<br><br>=C2=
=A0=C2=A0=C2=A0 # tag incoming packets from the tunnel and from<br>

=C2=A0=C2=A0=C2=A0 # the outside to the public ip address<br>=C2=A0=C2=A0=
=C2=A0 match in log(matches) on $c1_tunnel tag &quot;c1&quot;<br>=C2=A0=C2=
=A0=C2=A0 match in log(matches) on $phys_if from any to $c1_escape tag &quo=
t;c1&quot;<br><br>=C2=A0=C2=A0=C2=A0 # Allow incoming packet to port 80 and=
 redirect them to squid<br>

=C2=A0=C2=A0=C2=A0 pass in log(matches, all) on $c1_tunnel proto tcp to por=
t 80 \<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 rdr-to 127.0.0.1 port 1001 \<br>=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 reply-to ($c1_tunnel 10.0.0.5) \<br>=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 tagged &quot;c1&quot; label &quot;c1_proxied_traff=
ic&quot;<br><br>

<br><br>The result is that I cannot establish a tcp connection to port 80 f=
or a machine behing the gif tunnel, here is what tcpdump says on this machi=
ne ( tcpdump -s 0 -vlni &lt;interface&gt; port 80 ):<br><br>IP (tos 0x0, tt=
l=C2=A0 62, id 8175, offset 0, flags [DF], length: 60) &lt;client_address&g=
t;.21746 &gt; &lt;web_address&gt;.80: S [tcp sum ok] 3993732249:3993732249(=
0) win 65535 &lt;mss 1380,nop,wscale 3,sackOK,timestamp 442132554 0&gt;<br>

IP (tos 0x0, ttl=C2=A0 64, id 59219, offset 0, flags [DF], length: 64) &lt;=
web_address&gt;.80 &gt; &lt;client_address&gt;.21746: S [tcp sum ok] 333234=
7257:3332347257(0) ack 3993732250 win 16384 &lt;mss 1440,nop,nop,sackOK,nop=
,wscale 3,nop,nop,timestamp 2569862135 442132554&gt;<br>

<br>IP (tos 0x0, ttl=C2=A0 62, id 8176, offset 0, flags [DF], length: 52) &=
lt;client_address&gt;.21746 &gt; &lt;web_address&gt;.80: . [tcp sum ok] ack=
 1 win 8208 &lt;nop,nop,timestamp 442132595 2569862135&gt;<br>IP (tos 0x0, =
ttl=C2=A0 62, id 8189, offset 0, flags [DF], length: 54) &lt;client_address=
&gt;.21746 &gt; &lt;web_address&gt;.80: P [tcp sum ok] 1:3(2) ack 1 win 820=
8 &lt;nop,nop,timestamp 442134444 2569862135&gt;<br>

IP (tos 0x0, ttl=C2=A0 64, id 65354, offset 0, flags [DF], length: 58) &lt;=
web_address&gt;.80 &gt; &lt;client_address&gt;.21746: P [bad tcp cksum a676=
 (-&gt;a9cf)!] 1:7(6) ack 3 win 2052 &lt;nop,nop,timestamp 2569862139 44213=
4444&gt;<br>

<br>IP (tos 0x0, ttl=C2=A0 62, id 8190, offset 0, flags [DF], length: 54) &=
lt;client_address&gt;.21746 &gt; &lt;web_address&gt;.80: P [tcp sum ok] 1:3=
(2) ack 1 win 8208 &lt;nop,nop,timestamp 442134770 2569862135&gt;<br>IP (to=
s 0x0, ttl=C2=A0 64, id 23274, offset 0, flags [DF], length: 52) &lt;web_ad=
dress&gt;.80 &gt; &lt;client_address&gt;.21746: . [bad tcp cksum b6c8 (-&gt=
;ba21)!] ack 3 win 2052 &lt;nop,nop,timestamp 2569862139 442134770&gt;<br>

<br>IP (tos 0x0, ttl=C2=A0 62, id 8194, offset 0, flags [DF], length: 54) &=
lt;client_address&gt;.21746 &gt; &lt;web_address&gt;.80: P [tcp sum ok] 1:3=
(2) ack 1 win 8208 &lt;nop,nop,timestamp 442135222 2569862135&gt;<br>IP (to=
s 0x0, ttl=C2=A0 64, id 4613, offset 0, flags [DF], length: 52) &lt;web_add=
ress&gt;.80 &gt; &lt;client_address&gt;.21746: . [bad tcp cksum b503 (-&gt;=
b85c)!] ack 3 win 2052 &lt;nop,nop,timestamp 2569862140 442135222&gt;<br>

IP (tos 0x0, ttl=C2=A0 62, id 8199, offset 0, flags [DF], length: 54) &lt;c=
lient_address&gt;.21746 &gt; &lt;web_address&gt;.80: P [tcp sum ok] 1:3(2) =
ack 1 win 8208 &lt;nop,nop,timestamp 442135926 2569862135&gt;<br>IP (tos 0x=
0, ttl=C2=A0 64, id 41419, offset 0, flags [DF], length: 52) &lt;web_addres=
s&gt;.80 &gt; &lt;client_address&gt;.21746: . [bad tcp cksum b241 (-&gt;b59=
a)!] ack 3 win 2052 &lt;nop,nop,timestamp 2569862142 442135926&gt;<br>

<br>IP (tos 0x0, ttl=C2=A0 62, id 8205, offset 0, flags [DF], length: 52) &=
lt;client_address&gt;.21746 &gt; &lt;web_address&gt;.80: F [tcp sum ok] 3:3=
(0) ack 1 win 8208 &lt;nop,nop,timestamp 442136662 2569862135&gt;<br>IP (to=
s 0x0, ttl=C2=A0 62, id 8209, offset 0, flags [DF], length: 54) &lt;client_=
address&gt;.21746 &gt; &lt;web_address&gt;.80: FP [tcp sum ok] 1:3(2) ack 1=
 win 8208 &lt;nop,nop,timestamp 442137134 2569862135&gt;<br>

IP (tos 0x0, ttl=C2=A0 64, id 43519, offset 0, flags [DF], length: 58) &lt;=
web_address&gt;.80 &gt; &lt;client_address&gt;.21746: P [bad tcp cksum 9bee=
 (-&gt;9f47)!] 1:7(6) ack 3 win 2052 &lt;nop,nop,timestamp 2569862145 44213=
7134&gt;<br>

<br><br>There is only one packet from the web server (which is in fact my s=
erver since the request was redirected to squid ) which finds its way to th=
e client and after that all the checksum are wrong and I suppose the packet=
s are dropped since they never reach my client (which is curl). I tried to =
figure out why the checksum could be wrong but I am now out of ideas...<br>

<br>I hope someone can help me on this.<br><br>

--000e0cd149e06a2ef704a9ff0853--