Date: Sun, 31 Jul 2005 01:50:28 +0300 From: Abu Khaled <khaled.abu@gmail.com> To: "Giovanni P. Tirloni" <gpt@tirloni.org> Cc: pf@freebsd.org Subject: Re: rdr not working for transparent http - 5.4-stable Message-ID: <a64c109e050730155021f6551d@mail.gmail.com> In-Reply-To: <42EB7A2A.3080701@tirloni.org> References: <42E8D3D5.4030300@tirloni.org> <200507281458.56534.max@love2party.net> <42E8DBC6.6060907@tirloni.org> <42EB7A2A.3080701@tirloni.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 7/30/05, Giovanni P. Tirloni <gpt@tirloni.org> wrote: > Giovanni P. Tirloni wrote: > > Max Laier wrote: > > > >> One thing comes to my mind: What does > >> $sysctl net.inet.ip.forwarding > >> say? > > > > > > # sysctl net.inet.ip.forwarding > > net.inet.ip.forwarding: 1 > > > > I had some tweaks in /etc/sysctl but disabling them didn't help either. > > > > #net.inet.ip.check_interface=3D1 > > #net.inet.tcp.blackhole=3D2 > > #net.inet.udp.blackhole=3D1 > > >=20 > I forgot to mention this box had ipfw+dummnyet (with two queues) > activated. I disabled ipfw in the kernel and pf rdr worked again! Just > removing the ipfw rules didn't work. >=20 > Weird enough, I don't have dummynet on the other 2 machines that have > the same problem. But ipfw is compiled in but disabled. >=20 > I'll try to disable ipfw on the other boxes and see what happens there > to confirm this. If ipfw is compiled in the kernel and it defaults to deny all, then you need to add rules for ipfw to allow connections to and from localhost (127.0.0.1 and port 3128). Otherwise ipfw well drop 'pf rdr traffic'. # ipfw add allow tcp from $lan_net to 127.0.0.1 3128 # ipfw add allow tcp from 127.0.0.1 3128 to $lan_net Put the rules before any anti spoofing rules in ipfw. --=20 Regards. Abu Khaled
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?a64c109e050730155021f6551d>