From owner-freebsd-net@FreeBSD.ORG Mon Dec 2 08:42:48 2013 Return-Path: Delivered-To: net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 39C4064C for ; Mon, 2 Dec 2013 08:42:48 +0000 (UTC) Received: from mail-wg0-x232.google.com (mail-wg0-x232.google.com [IPv6:2a00:1450:400c:c00::232]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id C60041CA1 for ; Mon, 2 Dec 2013 08:42:47 +0000 (UTC) Received: by mail-wg0-f50.google.com with SMTP id a1so9778709wgh.29 for ; Mon, 02 Dec 2013 00:42:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=29N7aGykL6mBI68fR+uUMezOOpxDVCjVOSFL746EjwY=; b=c2Hetn9MISeREG2rah0oje8Ui/Uhbep+RjLwk9Mqy+3ml6JPyVjrGK8I92Ity+d3YR NEoKDmoBICUfomXd0opG/clhHERclRC6UYQjFX0vZh3QtAom/XregCw7WNGYd8D3JUcd M4VG0qexg/DvGs6MUyORW3qk1UU8Fxrht5HWIDPxr03KHHBnvJKVBU30ctapL0XOYfGd U3UsqrtO31h93h+5fVE1ynuxkkAMmAI5m6aymdHo6Vdm8K4aua+nNNXEkHVn3CqyP9dJ gnxQVghTu81tLBL6DhblwPLZsz7z3DmVEjdGLHkfVXNPp4Wr3riczV01A5AtRb8tB/qq rUNA== X-Received: by 10.180.89.68 with SMTP id bm4mr17179585wib.0.1385973766311; Mon, 02 Dec 2013 00:42:46 -0800 (PST) Received: from [192.168.2.30] ([2.176.198.47]) by mx.google.com with ESMTPSA id ll10sm120172426wic.9.2013.12.02.00.42.44 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 02 Dec 2013 00:42:45 -0800 (PST) Message-ID: <529C4801.3010000@gmail.com> Date: Mon, 02 Dec 2013 12:12:41 +0330 From: Hooman Fazaeli User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130215 Thunderbird/17.0.3 MIME-Version: 1.0 To: Yuri Subject: Re: DIOCNATLOOK fails with ipfw References: <529C3E84.1030203@rawbw.com> In-Reply-To: <529C3E84.1030203@rawbw.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: net@freebsd.org X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Dec 2013 08:42:48 -0000 On 12/2/2013 11:32 AM, Yuri wrote: > I have an app with transparent proxy that should intercept all TCP connections in the interface. > This is done with ipfw(8) rule like this: > ipfw add 200 fwd 192.168.10.1,15020 tcp from 192.168.10.0/24 to any 80 keep-state > Transparent proxy is on 192.168.10.1:15020 > > Proxy accepts the connections, however, it is using /dev/pf to get the original destination and the lookup procedure fails: > ioctl(DIOCNATLOOK) failed: No such file or directory > It fails because nobody ever calls pf_state_insert. I see from the source that ioctl to add the pf_state is DIOCSTART, which is issued by pfctl(8), but I am not using pfctl(8) at all. > > My questions are: > What is the relationship between ipfw(8) and pfctl(8)? Do they do the same? Why two of them? > If I only use ipfw, is there a way for the acceptor to find what the original destination was without /dev/pf? > > Yuri > _______________________________________________ ipfw and pf are two completely separate firewalls. You can not use /dev/pf to control/query ipfw. Use getsockname(2) to find out original destination address with ipfw. -- Best regards. Hooman Fazaeli