Date: Wed, 24 Oct 2007 10:49:01 +0200 From: Max Laier <max@love2party.net> To: freebsd-pf@freebsd.org Subject: Re: disabling implicit creation of state for NAT, BINAT and RDR Message-ID: <200710241049.10530.max@love2party.net> In-Reply-To: <1fc8a2a60710240051l4a5744bawacf48c47276ccba4@mail.gmail.com> References: <1fc8a2a60710232250i5954c8c3tc501ed4ec71dac80@mail.gmail.com> <20071024065938.GA20387@insomnia.benzedrine.cx> <1fc8a2a60710240051l4a5744bawacf48c47276ccba4@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1643430.QFMSolvSL8
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Wednesday 24 October 2007, Nex Mon wrote:
> On 10/24/07, Daniel Hartmeier <daniel@benzedrine.cx> wrote:
> > On Wed, Oct 24, 2007 at 01:50:55PM +0800, Nex Mon wrote:
> > > hello, is there a way to disable implicit creation of states for
> > > NAT,
> >
> > BINAT
> >
> > > and RDR rules? the man page of pf.conf says this:
> > >
> > > Note: nat, binat and rdr rules implicitly create state for
> > > connections.
> >
> > Yes, translations require states.
> >
> > Imagine you have a connection from
> >
> > Client Gateway External
> > 10.1.2.3 -> 62.65.145.30 -> 69.147.83.33
> >
> > i.e. the client 10.1.2.3 sends a TCP SYN to external server
> > 69.147.83.33. The NAT gateway replaces the source address with
> > 62.65.145.30.
> >
> > Now the external server sends a TCP SYN+ACK back to 62.65.145.30.
> > How would the gateway know that this packet is for 10.1.2.3, and
> > needs the destination address translated back to 10.1.2.3, without a
> > state entry?
> >
> > The state entry is the only part that holds this mapping information.
>
> Are you saying there is only one type of state for all the filter, RDR,
> etc rules? I have this understanding that NAT has its own translation
> table where it keeps states of NAT sessions. So in the example above,
> the only way to apply filter rules for translated (reply)packets would
> be at the internal interface?
The translations states are different from the filter states. The former=20
just record the addresses on each side to be able to do the translation,=20
the later record the addresses to be able to match traffic to the state=20
and consequently allow or deny it. Unless you use the "pass" modifier on=20
the translation statement, a translation state does not automatically=20
allow the matched traffic to flow. The pf.conf(5) manpage states:
If the pass modifier is given, packets matching the translation rule are
passed without inspecting the filter rules:
rdr pass on $ext_if proto tcp from any to any port 80 -> 127.0.0.1 \
port 8080
Otherwise you will have to have a pass rule for that traffic as well.
> I'm curious about OpenBSD's implementation of "no state" which can be
> applied to NAT, RDR, etc. Is there any chance this feature will be
> supported in FreeBSD?
The "no state" modifier is supported in FreeBSD (7.0 and later) for pass=20
rules only. This is the same in OpenBSD. Translation rules allways have=20
to keep state as they can otherwise not do the translation!
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart1643430.QFMSolvSL8
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (FreeBSD)
iD8DBQBHHwcGXyyEoT62BG0RAjkrAJ4ga5vWLy3Ewy+dfxRZ0f7AFokKuACffCc3
AQMtfp482+PbQTzwL384nNs=
=ffv9
-----END PGP SIGNATURE-----
--nextPart1643430.QFMSolvSL8--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200710241049.10530.max>