Subject: RE: odd ipf behaviour
To: None <current-users@netbsd.org>
From: Paul Newhouse <newhouse@rockhead.com>
List: current-users
Date: 12/01/1999 21:19:07
My apologies, I must have mis-communicated this problem.

>Was this tcpdump from interface ne0?

Yes.

>You have no explicit route to 204.177.156.26 (or its subnet)

I don't have an explict route for either of the addresses.

>You have no ipf rules to force 204.177.156.26 traffic back out ne0.

This rule:

  pass out log quick on de1 to ne0 from 24.1.4.202 to any

seems to work for forcing the packets that came in on ne0 back out ne0
for other addresses.

>Your ping replies are likely exiting on de1. 

No.  They come in on ne0 and dissappear.  I was running tcpdump on the
other two interfaces (de0 & de1) as well and there was no icmp traffic 
at all.

>Try traceroute -i ne0 204.177.156.26 and see if it tells you why your
>replies can't get to V via the @home connection.

They can't get back because they never leave.  They arrive and dissappear.
Traceroute from my LAN machine:

  % traceroute -i ne0 demeter.veritas.com
  traceroute to demeter.veritas.com (204.177.156.26), 30 hops max, 40 byte packets
  1  * * *
  2  * * *

  % traceroute -i de1 demeter.veritas.com
  traceroute to demeter.veritas.com (204.177.156.26), 30 hops max, 40 byte packets
      .
      .
      .
 11  demeter.veritas.com (204.177.156.26)  28.316 ms  24.282 ms  28.325 ms


The packets don't show up on any interface!?  I don't get it, where do these 
packets go?  This is weigh/whey/way to weird!! ;(

This worked on the previous kernel (3-4 months old) this newer kernel is
strange.  Except fo ip6 it's config'd in the same way.

Paul