From owner-freebsd-bugs@FreeBSD.ORG Sun Aug 2 09:10:02 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 94211106566B for ; Sun, 2 Aug 2009 09:10:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 6F9898FC14 for ; Sun, 2 Aug 2009 09:10:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n729A2if010507 for ; Sun, 2 Aug 2009 09:10:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n729A2sf010506; Sun, 2 Aug 2009 09:10:02 GMT (envelope-from gnats) Resent-Date: Sun, 2 Aug 2009 09:10:02 GMT Resent-Message-Id: <200908020910.n729A2sf010506@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Dmitriy Demidov Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 56BC4106564A for ; Sun, 2 Aug 2009 09:02:54 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id E8ADA8FC13 for ; Sun, 2 Aug 2009 09:02:53 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n7292rje038200 for ; Sun, 2 Aug 2009 09:02:53 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n7292rKS038198; Sun, 2 Aug 2009 09:02:53 GMT (envelope-from nobody) Message-Id: <200908020902.n7292rKS038198@www.freebsd.org> Date: Sun, 2 Aug 2009 09:02:53 GMT From: Dmitriy Demidov To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/137346: ipfw nat redirect_proto is broken X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Aug 2009 09:10:02 -0000 >Number: 137346 >Category: kern >Synopsis: ipfw nat redirect_proto is broken >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Aug 02 09:10:02 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Dmitriy Demidov >Release: FreeBSD 7.2-STABLE >Organization: >Environment: FreeBSD hius.local.home 7.2-STABLE FreeBSD 7.2-STABLE #0: Sun Jul 19 13:01:10 EEST 2009 root@hius.local.home:/usr/obj/usr/src/sys/STABLE i386 >Description: Looks like redirect_proto in ipfw nat is broken. I have NAT router with following config: fxp0 - LAN (192.168.1.1) em0 - WAN (8.9.0.100) # ipfw show 00100 214 45088 allow ip from any to any via lo0 00200 0 0 deny ip from any to 127.0.0.0/8 00300 0 0 deny ip from 127.0.0.0/8 to any 00400 2 100 count ip from any to any 00500 0 0 allow ip from any to any via fxp0 00600 2 100 count ip from any to any 00700 2 100 nat 1 log logamount 100 ip from any to any via em0 00800 0 0 count ip from any to any 65535 0 0 deny ip from any to any # ipfw nat 1 show nat 1: icmp=0, udp=0, tcp=2, pptp=0, proto=0, frag_id=0 frag_ptr=0 / tot=2 # ipfw nat 1 show config ipfw nat 1 config log redirect_proto tcp 192.168.1.2 8.9.0.100 On NAT router I don not have SSH daemon running. If I make a try to connect to 192.168.1.2 SSH (81.91.0.122 -> 8.9.0.100:22) from Internet via redirect_proto I got error: tcpdump -i 2 -vvv -n -l ip tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes 22:27:35.459508 IP (tos 0x0, ttl 64, id 51316, offset 0, flags [DF], proto TCP (6), length 60) 81.91.0.122.35654 > 8.9.0.100.22: S, cksum 0x6bc2 (correct), 2918273360:2918273360(0) win 5840 22:27:35.459638 IP (tos 0x0, ttl 64, id 298, offset 0, flags [DF], proto TCP (6), length 40) 8.9.0.100.22 > 81.91.0.122.35654: R, cksum 0x839f (correct), 0:0(0) ack 2918273361 win 0 So looks like redirect_proto do not works as expected here - it passes all incoming traffic into local machine (it do not alter destination IP address of packet as expected). >How-To-Repeat: Make a try to use redirect_proto in any ipfw nat configuration. >Fix: >Release-Note: >Audit-Trail: >Unformatted: