>Number:         22267
>Category:       kern
>Synopsis:       ipf fastroute and ipnat doesn't work
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 25 16:27:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     Mihai Chelaru
>Release:        NetBSD 1.6.1_STABLE
>Organization:
	None.
>Environment:
	
	
System: NetBSD vlad.local 1.6.1_STABLE NetBSD 1.6.1_STABLE (Poezie) #0: Fri Jul 25 16:08:36 EEST 2003 root@proxy-ines.posta-romana.ro:/usr/src/sys/arch/i386/compile/Poezie i386
Architecture: i386
Machine: i386
ipf: IP Filter: v3.4.29 (336)
Kernel: IP Filter: v3.4.29
>Description:
	ipf fastroute and ipnat are not working well togheter. here is the setup used:

	ne2 - internal interface (192.168.1.1/24)
	ne3 - provider 1 interface
	rtk0 - provider 2 interface

	ipnat.conf:
	map ne3 192.168.0.7/32 -> 194.102.250.216/32 proxy port ftp ftp/tcp
	map ne3 192.168.0.7/32 -> 194.102.250.216/32 portmap tcp/udp 40000:60000
	map ne3 192.168.0.7/32 -> 194.102.250.216/32

	ipf.conf:
	block in quick on ne2 to ne3 from 192.168.0.7/32 to any

	default route is set to rtk0 gateway

	running a ping -R 193.226.59.5 on 192.168.0.7 (an internal machine) and doing tcpdump:

	# tcpdump -nvpvvi ne3 icmp and host 193.226.59.5
	tcpdump: listening on ne3
	16:17:32.099168 194.102.250.216 > 193.226.59.5: icmp: echo request (ttl 128, id 39862, len 100, bad cksum cc24!, optlen=40 RR{#0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0} EOL)
	16:17:37.598976 194.102.250.216 > 193.226.59.5: icmp: echo request (ttl 128, id 39865, len 100, bad cksum cc21!, optlen=40 RR{#0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0} EOL)

	Using ipf fastroute without nat is behaving well.


>How-To-Repeat:
	
>Fix:
	
>Release-Note:
>Audit-Trail:
>Unformatted: