[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Strange behaviour with PF on FreeBSD 5.3-STABLE



On Friday 26 November 2004 19:05, Jonathan Weiss wrote:
> Hi Max,
>
> > You are supposed to have a NAT rule somewhere. Please let us know the
> > complete ruleset (including translation rules) and include match counters
> > so that people can figure if a certain rule is matched at all (pfctl -vv
> > -sn -sr).
>
> This was my complete ruleset, as I switched from my default ruleset in
> order to debug the problem.
>
> ext_if="ed0"
> int_if="vr0"
> tun_if="tun0"
> internal_net="192.168.0.0/24"
>
> set loginterface $tun_if
>
> #nat on $tun_if from $internal_net to any -> ($tun_if)
>
> #default block
> block return log-all
>
> pass on $tun_if
> pass on $ext_if
> pass on $int_if
>
> --------------------------------------
> pfctl -vv -sn -sr
> @0 block return log-all all
>   [ Evaluations: 2171      Packets: 1130      Bytes: 69021       States: 0
> @1 pass on tun0 all
>   [ Evaluations: 2171      Packets: 0         Bytes: 0           States: 0
Hmmm ... tun0 is never matched against. Can I have a look at $ifconfig and 
$pfctl -vvsI ? Also try to watch pflog ($ifconfig pflog0 up && tcpdump 
-vvvnei pflog0) What does it say?
> @2 pass on ed0 all
>   [ Evaluations: 2171      Packets: 0         Bytes: 0           States: 0
> @3 pass on vr0 all
>   [ Evaluations: 2171      Packets: 1041      Bytes: 65738       States: 0
>
> > Make sure that the NAT rule has dynamic address tracking (as I think you
> > get a dynamic IP from you ISP). The rule should look something like:
> >  nat on tun0 from $internalnet to any -> (tun0)
>
> I use the NAT from ppp, but I think that this is not related, as the
> problem occur at (or better: also at) the firewall (i386 FreeBSD 5.3-STABLE
> of yesterday). The firewall itself (and everything behind it) cannot
> connect over ppp to external servers when the default block rule is
> activated.
Hmmm - strange. Might be realted to the pf_if.c changes. What version are you 
running? RELENG_5? RELENG_5_3? HEAD? Did you (src-)update your kernel before 
the symptoms occurred?
pf_if.c:  1.5.2.2 (RELENG_5) or 1.7 (HEAD)?
> When I deactivate the rule, everything runs smoothly.
>
> > Also note, that we have a pf related mailinglist on FreeBSD, called
> > [email protected] You might want to subscribe and take the
> > discussion there: http://lists.freebsd.org/mailman/listinfo/freebsd-pf
>
> Thanks, I will suscribe. Should we change with this discussion the
> freebsd-centrinc mailinglist?
I just did.
-- 
/"\  Best regards,                      | [email protected]
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | [email protected]
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News

Attachment: pgp00200.pgp
Description: PGP signature