Date: Tue, 3 Oct 2006 17:10:41 -0700 (MST) From: "Jason DiCioccio" <jd@ods.org> To: "Cameron Murdoch" <cam@macaroon.net> Cc: freebsd-pf@freebsd.org Subject: Re: route-to being ignored? Message-ID: <3114.10.8.0.18.1159920641.squirrel@10.8.0.18> In-Reply-To: <4522FBAE.8020406@macaroon.net> References: <2712.10.8.0.18.1159916237.squirrel@10.8.0.18> <4522FBAE.8020406@macaroon.net>
next in thread | previous in thread | raw e-mail | index | archive | help
> Jason DiCioccio wrote: >> Greetings, >> I'm having a bit of an issue here with pf and the route-to statement >> on >> 6.1-RELEASE-p3/i386. >> >> >> Basically, I have the following rule (at the top of my rules, no >> less): >> >> pass out quick route-to ( tun0 10.8.1.5 ) from 66.29.58.71/32 to any >> >> I've tried this rule with keep state, without keep state, with quick, >> without quick, basically everything I could think of. And I haven't >> been able to get this to do anything at all. Traffic is still flowing >> out of ng0 (where the default route resides). >> >> 66.29.58.71 is an IP bound to lo0 on the server. Traffic for it comes >> in over tun0, for which the ifconfig follows: >> >> tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500 >> inet6 fe80::24a7:3207:1aa1:c985%tun0 prefixlen 64 scopeid 0xa >> inet 10.8.1.6 --> 10.8.1.5 netmask 0xffffffff >> Opened by PID 347 >> >> Currently if I do a tcpdump on ng0, I can see the ICMP Echo replies >> going back out over ng0 while the requests come in over tun0. I should >> also note that I haven't been able to get this working with ipfw fwd >> either. >> >> options IPFIREWALL_FORWARD is in the kernel config as well. >> >> Anyone have any idea what I'm missing? > > If the traffic is coming in on tun0 then you probably want reply-to not > route-to. Sorry, I should've mentioned that I've tried this too. It's possible that I did it wrong, but I did variations of this: pass in quick on tun0 reply-to ( tun0 10.8.1.5 ) from any to 66.29.58.71/32 keep state If I'm doing this wrong, let me know. Regards, -JD-
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3114.10.8.0.18.1159920641.squirrel>