Date: Thu, 16 Mar 2017 09:12:05 -0400 From: Mike Tancsa <mike@sentex.net> To: =?UTF-8?Q?Ermal_Lu=c3=a7i?= <eri@freebsd.org>, Kristof Provost <kristof@sigsegv.be> Cc: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org> Subject: Re: pf bug with tun interfaces ? Message-ID: <f864a792-dbed-4fe7-a51b-fc008f00cf2d@sentex.net> In-Reply-To: <CAPBZQG1ERvAfB2XwXZN=hy0t9-DyUN8PT6JpR95Fp7YJqNtuxA@mail.gmail.com> References: <1b605589-9642-ee92-fb9b-9ff5b4798316@sentex.net> <e1679f63-247c-1da6-8f57-30c5dd23304e@sentex.net> <AD6E6EB9-9FD8-4B9C-B401-2D750F17FA40@sigsegv.be> <6582cf37-08b0-9083-0c3e-1396a885d005@sentex.net> <CD5336F5-4146-4F2E-A92C-D74717979A92@sigsegv.be> <CAPBZQG1ERvAfB2XwXZN=hy0t9-DyUN8PT6JpR95Fp7YJqNtuxA@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 3/16/2017 2:15 AM, Ermal Luçi wrote:
>
>
> On Wed, Mar 15, 2017 at 7:33 PM, Kristof Provost <kristof@sigsegv.be
> <mailto:kristof@sigsegv.be>> wrote:
>
> On 15 Mar 2017, at 22:10, Mike Tancsa wrote:
>
> On 3/15/2017 4:28 AM, Kristof Provost wrote:
>
> I don’t see any obvious reason why that would happen.
>
> Can you reduce this to a minimal test setup and include
> rc.conf, pf.conf, …
> with a bug report in bugzilla?
>
>
> is it possible that its how OpenVPN sets up the tun interface ?
> Otherwise nat via pf on ppp connections would not work either.
>
> I’m not aware of anything, but I’m not very familiar with OpenVPN.
>
>
> The only time this will not work is when tun interface does not have an
> ip assigned.
> So your rule will not work with (tun) syntax.
>
> Otherwise it does not depend on anything else other than general ifnet
> What FreeBSD Version is this?
RELENG_10. I will have to dig out an old image, but I am pretty sure I
was able to do this on a RELENG_8 box. The interface has an IP
eg
tun91: flags=8151<UP,POINTOPOINT,RUNNING,PROMISC,MULTICAST> metric 0 mtu
1500
options=80000<LINKSTATE>
inet 10.61.0.1 --> 10.61.0.2 netmask 0xffffffff
Opened by PID 5778
Not sure why it chooses such a netmask, but it does that. I tried
manually setting the natting IP, but no difference.
---Mike
--
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike@sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada http://www.tancsa.com/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?f864a792-dbed-4fe7-a51b-fc008f00cf2d>