Confusion between internal and external network addresses

[Thomas Klausner <wiz%NetBSD.org@localhost>]

Hi!

I'm seeing the following behaviour, which I don't understand.
I ping a host on an internal network, but the ping reply
comes from the external IP of the pinged host.

In detail:

Gateway host GW:
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        
capabilities=3f00<IP4CSUM_Rx,IP4CSUM_Tx,TCP4CSUM_Rx,TCP4CSUM_Tx,UDP4CSUM_Rx,UDP4CSUM_Tx>
        enabled=0
        address: 00:...
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 192.168.0.33 netmask 0xffffff00 broadcast 192.168.0.255
        inet6 fe80::224:....%re0 prefixlen 64 scopeid 0x2
(external)

re1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        
capabilities=3f00<IP4CSUM_Rx,IP4CSUM_Tx,TCP4CSUM_Rx,TCP4CSUM_Tx,UDP4CSUM_Rx,UDP4CSUM_Tx>
        enabled=0
        address: 00:...
        media: Ethernet autoselect (1000baseT full-duplex)
        status: active
        inet 10.0.0.7 netmask 0xff000000 broadcast 10.255.255.255
        inet6 fe80::224:....%re1 prefixlen 64 scopeid 0x3
(internal)

Internal host IH:
wm0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        
capabilities=2bf80<TSO4,IP4CSUM_Rx,IP4CSUM_Tx,TCP4CSUM_Rx,TCP4CSUM_Tx,UDP4CSUM_Rx,UDP4CSUM_Tx,TCP6CSUM_Tx,UDP6CSUM_Tx>
        enabled=0
        address: 00:....
        media: Ethernet autoselect (1000baseT full-duplex)
        status: active
        inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
        inet6 fe80::224:....%re1 prefixlen 64 scopeid 0x3
# ping -n 10.0.0.7
PING 10.0.0.7 (10.0.0.7): 56 data bytes
64 bytes from 192.168.0.33: icmp_seq=0 ttl=255 time=0.463
...

In particular, this came up because I had trouble using ftp 10.0.0.7;
it didn't work; then I tried ping and saw the above.

On GW, "ftp 10.0.0.7" works, and on IH, after adding 10.0.0.7 as
default route, ftp 192.168.0.33 works.

GW is running 5.99.16/amd64 with ipnat=YES and ipfilter=YES, options
GATEWAY in the kernel, net.inet.ip.forwarding = 1.
IH is booted from a 5.0/amd64 install CD.

Can someone please explain to me what's happening here? Is this a bug?
 Thomas