From owner-freebsd-net@freebsd.org  Thu Jul 23 15:38:47 2015
Return-Path: <owner-freebsd-net@freebsd.org>
Delivered-To: freebsd-net@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 33DAF9A84FF
 for <freebsd-net@mailman.ysv.freebsd.org>;
 Thu, 23 Jul 2015 15:38:47 +0000 (UTC)
 (envelope-from bugzilla-noreply@freebsd.org)
Received: from kenobi.freebsd.org (kenobi.freebsd.org
 [IPv6:2001:1900:2254:206a::16:76])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 2061319F9
 for <freebsd-net@FreeBSD.org>; Thu, 23 Jul 2015 15:38:47 +0000 (UTC)
 (envelope-from bugzilla-noreply@freebsd.org)
Received: from bugs.freebsd.org ([127.0.1.118])
 by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id t6NFcktt035295
 for <freebsd-net@FreeBSD.org>; Thu, 23 Jul 2015 15:38:46 GMT
 (envelope-from bugzilla-noreply@freebsd.org)
From: bugzilla-noreply@freebsd.org
To: freebsd-net@FreeBSD.org
Subject: [Bug 201590] Zerowindow packets escape stateful in-kernel NAT
Date: Thu, 23 Jul 2015 15:38:46 +0000
X-Bugzilla-Reason: AssignedTo
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: Base System
X-Bugzilla-Component: kern
X-Bugzilla-Version: 10.1-RELEASE
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: Affects Only Me
X-Bugzilla-Who: g_amanakis@yahoo.com
X-Bugzilla-Status: New
X-Bugzilla-Priority: ---
X-Bugzilla-Assigned-To: freebsd-net@FreeBSD.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-201590-2472-9Iov6ZuCD8@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-201590-2472@https.bugs.freebsd.org/bugzilla/>
References: <bug-201590-2472@https.bugs.freebsd.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Jul 2015 15:38:47 -0000

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=201590

--- Comment #7 from g_amanakis@yahoo.com ---
(In reply to smithi from comment #6)
I think this has nothing to do with the local interface, simply because the
keepalive packets are generated from the *gateway* through ipfw_dyn_send_ka().
Commenting out the function resolves the symptoms. The actual sending takes
place in check_dyn_rules() through ip_output().

The keepalive seems to be generated from the gateway on the basis of the
dynamic rule, and this is before the outgoing NAT takes place, i.e. with the IP
of the LAN.

-- 
You are receiving this mail because:
You are the assignee for the bug.