From owner-freebsd-pf@FreeBSD.ORG Wed Oct 4 00:48:41 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B5A3B16A412 for ; Wed, 4 Oct 2006 00:48:41 +0000 (UTC) (envelope-from jd@ods.org) Received: from update.ods.org (update.ods.org [66.246.72.188]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0435C43D46 for ; Wed, 4 Oct 2006 00:48:40 +0000 (GMT) (envelope-from jd@ods.org) Received: from localhost (221056.ds.nac.net [127.0.0.1]) by update.ods.org (Postfix) with ESMTP id 6945B28FA0; Tue, 3 Oct 2006 20:48:40 -0400 (EDT) X-Virus-Scanned: amavisd-new at ods.org Received: from update.ods.org ([127.0.0.1]) by localhost (update.ods.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K44GL5NFkbk3; Tue, 3 Oct 2006 20:48:38 -0400 (EDT) Received: from webmail.ods.org (221056.ds.nac.net [127.0.0.1]) by update.ods.org (Postfix) with ESMTP id 2B4F728FA2; Tue, 3 Oct 2006 20:48:38 -0400 (EDT) Received: from 10.8.0.18 (SquirrelMail authenticated user geniusj); by webmail.ods.org with HTTP; Tue, 3 Oct 2006 17:48:38 -0700 (MST) Message-ID: <3286.10.8.0.18.1159922918.squirrel@10.8.0.18> In-Reply-To: <3114.10.8.0.18.1159920641.squirrel@10.8.0.18> References: <2712.10.8.0.18.1159916237.squirrel@10.8.0.18> <4522FBAE.8020406@macaroon.net> <3114.10.8.0.18.1159920641.squirrel@10.8.0.18> Date: Tue, 3 Oct 2006 17:48:38 -0700 (MST) From: "Jason DiCioccio" To: "Jason DiCioccio" User-Agent: SquirrelMail/1.4.3a X-Mailer: SquirrelMail/1.4.3a MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal Cc: freebsd-pf@freebsd.org Subject: SOLVED: route-to being ignored? X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Oct 2006 00:48:41 -0000 OK. I finally got this working.. Apparently you can't have a reply-to rule along with an rdr rule. I guess pf won't track state for both filtering and rewriting at the same time. Thanks! -JD- >> Jason DiCioccio wrote: >>> Greetings, >>> I'm having a bit of an issue here with pf and the route-to statement >>> on >>> 6.1-RELEASE-p3/i386. >>> >>> >>> Basically, I have the following rule (at the top of my rules, no >>> less): >>> >>> pass out quick route-to ( tun0 10.8.1.5 ) from 66.29.58.71/32 to any >>> >>> I've tried this rule with keep state, without keep state, with quick, >>> without quick, basically everything I could think of. And I haven't >>> been able to get this to do anything at all. Traffic is still flowing >>> out of ng0 (where the default route resides). >>> >>> 66.29.58.71 is an IP bound to lo0 on the server. Traffic for it >>> comes >>> in over tun0, for which the ifconfig follows: >>> >>> tun0: flags=8051 mtu 1500 >>> inet6 fe80::24a7:3207:1aa1:c985%tun0 prefixlen 64 scopeid 0xa >>> inet 10.8.1.6 --> 10.8.1.5 netmask 0xffffffff >>> Opened by PID 347 >>> >>> Currently if I do a tcpdump on ng0, I can see the ICMP Echo replies >>> going back out over ng0 while the requests come in over tun0. I should >>> also note that I haven't been able to get this working with ipfw fwd >>> either. >>> >>> options IPFIREWALL_FORWARD is in the kernel config as well. >>> >>> Anyone have any idea what I'm missing? >> >> If the traffic is coming in on tun0 then you probably want reply-to not >> route-to. > > Sorry, I should've mentioned that I've tried this too. It's possible that > I did it wrong, but I did variations of this: > > pass in quick on tun0 reply-to ( tun0 10.8.1.5 ) from any to > 66.29.58.71/32 keep state > > If I'm doing this wrong, let me know. > > Regards, > -JD- > >