From owner-freebsd-stable Sat May 20 9:20:38 2000 Delivered-To: freebsd-stable@freebsd.org Received: from point.osg.gov.bc.ca (point.osg.gov.bc.ca [142.32.102.44]) by hub.freebsd.org (Postfix) with ESMTP id 1472F37B741 for ; Sat, 20 May 2000 09:20:29 -0700 (PDT) (envelope-from Cy.Schubert@uumail.gov.bc.ca) Received: (from daemon@localhost) by point.osg.gov.bc.ca (8.8.7/8.8.8) id JAA11729; Sat, 20 May 2000 09:20:09 -0700 Received: from passer.osg.gov.bc.ca(142.32.110.29) via SMTP by point.osg.gov.bc.ca, id smtpda11727; Sat May 20 09:20:03 2000 Received: (from uucp@localhost) by passer.osg.gov.bc.ca (8.9.3/8.9.1) id JAA07771; Sat, 20 May 2000 09:20:01 -0700 (PDT) Received: from cwsys9.cwsent.com(10.2.2.1), claiming to be "cwsys.cwsent.com" via SMTP by passer9.cwsent.com, id smtpdMc7761; Sat May 20 09:19:14 2000 Received: (from uucp@localhost) by cwsys.cwsent.com (8.10.1/8.9.1) id e4KGJEL03648; Sat, 20 May 2000 09:19:14 -0700 (PDT) Message-Id: <200005201619.e4KGJEL03648@cwsys.cwsent.com> Received: from localhost.cwsent.com(127.0.0.1), claiming to be "cwsys" via SMTP by localhost.cwsent.com, id smtpdvm3644; Sat May 20 09:18:30 2000 X-Mailer: exmh version 2.1.1 10/15/1999 X-Exmh-Isig-CompType: repl X-Exmh-Isig-Folder: security/IP-Filter Reply-To: Cy Schubert - ITSD Open Systems Group From: Cy Schubert - ITSD Open Systems Group X-OS: FreeBSD 4.0-STABLE X-Sender: cy To: Gert-Jan Vons Cc: ipfilter@coombs.anu.edu.au, freebsd-stable@freebsd.org Subject: Re: FTP proxy without translation no longer working? In-reply-to: Your message of "Fri, 19 May 2000 09:37:28 +0200." <4.3.1.2.20000519092049.00b809e0@mail.vons.local> Mime-Version: 1.0 Content-Type: text/plain Date: Sat, 20 May 2000 09:18:29 -0700 Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Added freebsd-stable@freebsd.org to the cc list, as the solution may be found there as well as on the IP Filter mailing list. In message <4.3.1.2.20000519092049.00b809e0@mail.vons.local>, Gert-Jan Vons wri tes: > At 02:43 19/05/2000 +1000, Darren Reed wrote: > > >In some email I received from Jefferson Ogata, sie wrote: > >[...] > > > Well, I'm having a really insane problem, and it's not making me happy. > > > ... > > > All IP Filter filtering and NAT features appear to work on both types, > > > with the exception of FTP proxying. I haven't tested rdr. > > > >Both sets of rules are equivalent, with: > > > >map foo0 1.2.3.4/32 -> 5.6.7.8/32 proxy port ftp ftp/tcp > > > >(there is a bug with 0/32 on the RHS in 3.3.14) > > Can you tell me more about that bug? (do you have a work-around or a fix?) > > I am seeing problems with NAT and I do have a 0/32 on the RHS. Actually it's the 0/0 part of the rule. For example: map xl0 10.1.1.0/24 -> 0.0.0.0/32 proxy port ... works map xl0 0.0.0.0/0 -> 0.0.0.0/32 proxy port ... doesn't map xl0 10.1.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 40000:60000 works map xl0 0.0.0.0/0 -> 0.0.0.0/32 portmap tcp/udp 40000:60000 doesn't > > I started with FreeBSD 4.0-Release, ipfilter 3.3.13, and ppp from 11-4-2000. > > I updated in steps to 3.3.14 and then 3.4.2 (for those who mailed me about > the -Werror, thanks for your help!), then installed the latest ppp of > 11-5-2000, and was preparing to install a 4.0-Stable kernel. > > I haven't a clear description of the problem. Once I saw a SYN go out but > nothing coming back, another time I didn't even see a SYN going out. I once > got the impression that an "ipnat -CF -f /etc/ipnat.rules" made things > work, but that may have been a coincidence. > > I don't have much time at the moment to investigate further (maybe in a > week or two), so if this corresponds to a known problem... I think that something in FreeBSD has changed. -stable as of April 22 had no problems with the commented out rules under 3.3.x and 3.4.3: # map xl0 0.0.0.0/0 -> 0.0.0.0/32 proxy port ftp ftp/tcp map xl0 10.1.1.0/24 -> 0.0.0.0/32 proxy port ftp ftp/tcp map xl0 10.1.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 40000:60000 map xl0 10.1.1.0/24 -> 0.0.0.0/32 map tun0 10.1.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 40000:60000 map tun0 10.1.1.0/24 -> 0.0.0.0/32 map ppp0 10.1.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 40000:60000 map ppp0 10.1.1.0/24 -> 0.0.0.0/32 map tun3 10.1.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 40000:60000 map tun3 10.1.1.0/24 -> 0.0.0.0/32 # map tun3 0.0.0.0/0 -> 0.0.0.0/32 proxy port ekshell rcmd/tcp # map tun3 0.0.0.0/0 -> 0.0.0.0/32 proxy port kshell rcmd/tcp # map tun3 0.0.0.0/0 -> 0.0.0.0/32 proxy port shell rcmd/tcp tun3 is a VPN (IPSec) session to my employer's site. As of FreeBSD-stable from May 17 the 0/0 rules no longer work under either IPF 3.3.15 or IPF 3.4.3. I think that the FreeBSD IP stack was either broken or the FreeBSD IP stack is evolving in some way that is incompatible with IP Filter (nobody's fault). The symptoms using FreeBSD-4.0-STABLE as of May 17 are: - No route to host messages or hung sessions, depending on the protocol. Yet pings and traceroutes work. - Adding the rule: map tun3 0.0.0.0/0 -> 0.0.0.0/32 portmap tcp/udp 40000:60000 causes outbound telnet sessions to hang. This is not a proxy problem but is related to NAT. - NAT from systems on the LAN, through the gateway, e.g. the uncommented NAT rules, work. In other words only NAT (proxy or otherwise) sessions from the gateway itself fail. This seems to indicate that FreeBSD's routing code has changed since a month ago, as IPF injects the NATed packets back into the IP stack for the routing tables to route (e.g. not Darren's fault). I can see two paths to the solution: 1. FreeBSD IP stack is regressed or fixed to allow IP Filter to inject packets into the stack (routing) as it did in April, or 2. Darren finds out what has changed, how it affects IP Filter and adjusts IP Filter. Regards, Phone: (250)387-8437 Cy Schubert Fax: (250)387-5766 Team Leader, Sun/DEC Team Internet: Cy.Schubert@osg.gov.bc.ca Open Systems Group, ITSD, ISTA Province of BC To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message