Date: Thu, 27 Jul 2006 23:11:59 -0700 From: Jeffrey Williams <jeff@sailorfej.net> To: freebsd-pf@freebsd.org Subject: Re: nat/outbound traffic not passing in pf on FreeBSD 6.1 Message-ID: <44C9AAAF.1090705@sailorfej.net> In-Reply-To: <20060726202454.GG18492@insomnia.benzedrine.cx> References: <44C71D8F.9090007@sailorfej.net> <20060726202454.GG18492@insomnia.benzedrine.cx>
next in thread | previous in thread | raw e-mail | index | archive | help
Daniel and all on list, Thank you and mea culpa, I should have tried that first. tcpdump showed no packets coming in from the inside network on em1 (even with pf disabled), although the aggregate port switch saw them. so it is either bad switch configuration (likely, my first time with a Dell switch) or bad switch port. Either way it does not appear to be pf/FreeBSD's fault, after moving the inside interface to another port, it works fine. Although I was able to ssh from em1 out to machines on the inside network, weird, I have revisit this when I have time. Thanks, Jeff Daniel Hartmeier wrote: > Can you give us an example of just one connection that doesn't work? > > Like, local workstation i.i.10.3, connected to em1, matching $inwr, > tries to connect to an external host 62.65.145.30. Protocol TCP, source > port 12345, destination port 80. The TCP SYN is seen (with tcpdump) > incoming on em1. But it's not seen outgoing (NAT'ed to source address > o.o.33.46) on em0. > >> scrub in all fragment reassemble >> block drop in log all >> pass in on em0 inet proto tcp from any to i.i.10.15 port = ssh keep state >> pass in on em0 inet proto tcp from any to o.o.33.46 port = ssh keep state >> pass in on em1 inet from i.i.10.0/24 to any keep state >> pass out on em0 inet from o.o.33.46 to any keep state >> block drop in on ! em0 inet from o.o.33.i/29 to any >> block drop in on em0 inet6 from fe80::213:72ff:fe5f:6e6b to any >> block drop in inet from o.o.33.46 to any >> block drop in on ! em1 inet from i.i.10.0/24 to any >> block drop in on em1 inet6 from fe80::213:72ff:fe5f:6e6c to any >> block drop in inet from i.i.10.1 to any > > A packet that doesn't match any of those rules will be passed. Since you > don't block outgoing packets at all, you should see the TCP SYN go out > on em1 (properly NAT'ed). Since NAT implies keep state, a state entry > should be created even if you don't have an explicit 'pass out keep > state' rule. > > Your pfctl -si output shows that there are states created, and that > packets are matching those states and passing. > > You should see the returning TCP SYN+ACK incoming on em1 (with tcpdump), > get NAT'ed back to the internal destination address, and leave out on > em0. > > Make sure that there's nothing weird going on with the network cables, > i.e. that em0 is really the internal NIC, that the local workstation > does not have any other way to reach the external host except through > the pf box, and that it's using the pf box as default gateway. > > If the TCP SYN and SYN+ACK show up in any other order (than described > above) on the two interfaces, that would be the clue to the problem. > > There is no difference between pf on OpenBSD and FreeBSD in this regard, > and I very much doubt there is a bug as basic as this still undetected. > More likely, there is some other difference between your OpenBSD and > FreeBSD setups, as simple as a cable plugged in somewhere :) > > Daniel
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44C9AAAF.1090705>