Date: Thu, 01 Sep 2005 10:56:29 +0300 From: Casper <kl@os.lv> To: questions@FreeBSD.org Subject: FreeBSD 5.4 router with pf nat, bug? Message-ID: <4316B42D.5020503@os.lv>
next in thread | raw e-mail | index | archive | help
Hi, I have 5.4-RELEASE-p6 test router and I wanted to do all routing/fw with pf, to learn more pf... I have added to kernel options: device pf device pflog device pfsync options ALTQ Setuped jails with 172.22.x.x address and local network I have 192.168.x.x addreses... ifconfig rl0 is real ip and maped jails... rl1 is internal network... /etc/pf.conf now looks like: --------------------------------------------- ext_if="rl0" int_if="rl1" set state-policy if-bound set loginterface $ext_if scrub reassemble tcp fragment reassemble nat on $ext_if from 172.1.1.1/8 to any -> ($ext_if) nat on $ext_if from 192.168.1.1/8 to any -> $ext_if rdr on $ext_if proto tcp from any to 159.148.155.14 port 8080 -> 172.22.1.2 port www antispoof log quick for $ext_if inet antispoof log quick for $int_if inet block in log quick on $ext_if inet from any to ! ($ext_if) pass quick on lo0 all pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh flags S/SA synproxy state ----------------------------------------------------------------------- The problem is when I make conection from jail or internal network, any conection http, ping, etc first package goes trought and got reply, second no... like: # traceroute www.ass.lv traceroute to www.ass.lv (195.13.160.54), 64 hops max, 40 byte packets 1 my_router (my_router) 0.166 ms 0.143 ms 0.130 ms 2 * next_router (next_router) 1.274 ms * 3 titan-v12-gw.latnet.lv (159.148.13.150) 1.970 ms * 1.992 ms 4 * 80.232.230.89 (80.232.230.89) 2.205 ms * From my_router all working ok: 1 next_router (next_router) 1.331 ms 0.962 ms 1.037 ms 2 titan-v12-gw.latnet.lv (159.148.13.150) 1.287 ms 0.757 ms 1.660 ms 3 80.232.230.89 (80.232.230.89) 1.218 ms 2.233 ms 1.352 ms So only nat`ed packages every second get lost... with tcpdump and pf loging all shows that nothing is blocking them... Any idea what is going on or how to test where is problem? tnx, K.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4316B42D.5020503>