From owner-freebsd-ipfw@freebsd.org Thu Mar 10 20:24:34 2016 Return-Path: Delivered-To: freebsd-ipfw@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 32F88ACBBB0 for ; Thu, 10 Mar 2016 20:24:34 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "vps1.elischer.org", Issuer "CA Cert Signing Authority" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id EC160ABA; Thu, 10 Mar 2016 20:24:33 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from julian-mbp3.pixel8networks.com (50-196-156-133-static.hfc.comcastbusiness.net [50.196.156.133]) (authenticated bits=0) by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id u2AKOOXW087534 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Thu, 10 Mar 2016 12:24:26 -0800 (PST) (envelope-from julian@freebsd.org) Subject: Re: ipwf dummynet vs. kernel NAT and firewall rules To: Don Lewis , fjwcash@gmail.com References: <201603092101.u29L0wwH011694@gw.catspoiler.org> Cc: freebsd-ipfw@freebsd.org From: Julian Elischer Message-ID: <56E1D7F3.5040101@freebsd.org> Date: Thu, 10 Mar 2016 12:24:19 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: <201603092101.u29L0wwH011694@gw.catspoiler.org> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 20:24:34 -0000 On 9/03/2016 1:00 PM, Don Lewis wrote: > On 9 Mar, Don Lewis wrote: >> On 9 Mar, Don Lewis wrote: >>> On 9 Mar, Freddie Cash wrote: >>>> ?Do you have the sysctl net.inet.ip.fw.one_pass set to 0 or 1? >>> Aha, I've got it set to 1. >>> >>>> If set to 1, the a dummynet match ends the trip through the rules, and the >>>> packet never gets to the NAT rules. Or, if a NAT rule matches, the trip >>>> through the rules ends, and it never get to the dummynet rules. Depending >>>> on which you have first. >>> Dummynet is first. >>> >>>> You'll need to set net.inet.ip.fw.one_pass?=0 in order to re-inject the >>>> packet into the rules after it matches a dummynet or NAT rule. Or, do the >>>> NAT and dummynet rules on different interfaces to match different traffic. >>> How do I prevent the re-injected packets from being sent back into >>> dummynet? My NAT rule looks like it could have the same problem, but >>> that looks fixable. >> I just read the fine man page and is says that after re-injection the >> packet starts with the next rule ... cool! actually it doesn't... it starts at the next rule NUMBER which may be a different thing. > Ignoring dummynet for a moment since I haven't added those rules back > ... DNS lookups break when I set net.inet.ip.fw.one_pass=0. This > machine is running BIND as a DNS forwarder and I have this rule to > allow DNS lookups in and out: > pass udp from me to any 53 out via re0 keep-state > > If BIND has the results of a lookup cached, then I get the expected > query results from an internal host when I set > net.inet.ip.fw.one_pass=0, but if the results are not cached I get > ";; connection timed out; no servers could be reached" when I do a > lookup on an internal host, and running the query on the firewall > machine also does not work. If BIND has the query cached, I am able > to download from servers on the internet to an internal host, so that > indicates that NAT is functioning, but it shouldn't be involved in DNS > lookups. > > > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" >