Date: Sun, 31 Jul 2005 19:13:58 +0200 From: Max Laier <max@love2party.net> To: freebsd-pf@freebsd.org Cc: Tilman Linneweh <arved@arved.at> Subject: Re: PF on 6.0 and ICQ Message-ID: <200507311914.03774.max@love2party.net> In-Reply-To: <c31937ef582c09322bd67c932e176602@arved.at> References: <c31937ef582c09322bd67c932e176602@arved.at>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart3390795.jxlMpqPJV4
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Sunday 31 July 2005 17:58, Tilman Linneweh wrote:
> Hi list,
>
> I upgraded my Firewall to RELENG_6,
> the Firewall does NAT for an RFC1918 net, and the relevant part of the
> ruleset looks like this:
>
> nat on $ext_if from $internal_net to any -> ($ext_if)
> pass in on $int_if from {$internal_net, 224.0.0.0/4} to any keep state
> allow-opts
> pass out on $int_if from any to {$internal_net, 224.0.0.0/4} keep state
> allow-opts
> pass out on $ext_if proto { tcp, udp } all keep state
>
> With RELENG_5 ICQ from the hosts on the RFC1918 network worked, but now
> they are not able to connect to the ICQ
> Server.
>
> The logged traffic on pflog0 looks like this:
> 17:45:25.966685 IP (tos 0x0, ttl 62, id 63506, offset 0, flags [DF],
> proto: TCP (6), length: 60) 192.168.1.24.49231 > 205.188.7.248.5190: S
> 920618149:920618149(0) win 65535 <mss 1460,nop,wscale 0,[|tcp]>
> 17:45:28.871854 IP (tos 0x0, ttl 62, id 63512, offset 0, flags [DF],
> proto: TCP (6), length: 60) 192.168.1.24.49231 > 205.188.7.248.5190: S
> 920618149:920618149(0) win 65535 <mss 1460,nop,wscale 0,[|tcp]>
> 17:45:31.872076 IP (tos 0x0, ttl 62, id 63515, offset 0, flags [DF],
> proto: TCP (6), length: 60) 192.168.1.24.49231 > 205.188.7.248.5190: S
> 920618149:920618149(0) win 65535 <mss 1460,nop,wscale 0,[|tcp]>
> 17:45:34.874595 IP (tos 0x0, ttl 62, id 63518, offset 0, flags [DF],
> proto: TCP (6), length: 44) 192.168.1.24.49231 > 205.188.7.248.5190: S,
> cksum 0x7097 (correct), 920618149:920618149(0) win 65535 <mss 1460>
> 17:45:37.874576 IP (tos 0x0, ttl 62, id 63520, offset 0, flags [DF],
> proto: TCP (6), length: 44) 192.168.1.24.49231 > 205.188.7.248.5190: S,
> cksum 0x7097 (correct), 920618149:920618149(0) win 65535 <mss 1460>
>
> Anyone got an idea, why this traffic doesn't match the pass rules
> anymore?
Can you add a "-e" when tcpdump'ing pflog so it shows the reason for the dr=
op=20
(i.e. what rule was matched etc.)?
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart3390795.jxlMpqPJV4
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (FreeBSD)
iD8DBQBC7QbbXyyEoT62BG0RAtTPAJ9BtQ5RTflPrhTcewb6Tzz5S0SWsQCdFh+X
yYxPRLXjfTTKdWKpTwFYhqw=
=3fLS
-----END PGP SIGNATURE-----
--nextPart3390795.jxlMpqPJV4--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200507311914.03774.max>