Subject: IPfilter blocking on the wrong interface?
To: None <>
From: Wouter Schoot <>
List: netbsd-users
Date: 09/27/2004 14:06:02
Hello all listreaders,

I'm using ipfilter on my netbsd machine to take some control over the flows,
and I stumbled into a weird problem lately.

Here's the situation:

---       ---
|A| ===== |B| ==> Internet
---       ---

Computer A is on an internal, local subnet. It has IP adres
Computer B has two nics, one is ex1, with IP, and the other is ex0
with (internet) ip address (Yes, the same ip that hosts the
NetBSD 2.0 beta iso's:

This is your average NAT setup, I figured:
map ex0 -> 0/32 proxy port ftp ftp/tcp
map ex0 -> 0/32 portmap tcp/udp 40000:60000
map ex0 -> 0/32

Take the following line:
block in quick on ex0 from any to

I put it there to prevent the outer networkcard (connected to the internet)
from packets destinated for internal networks. I figured, they should not
end up at my external interface.

But here's the catch. When I have that block rule enabled, machine A can't
connect to the internet anymore. Connecting to goes fine, but no
internet anymore.

When I 'ipfstat -hi' with the rule enabled, and ping some on A to the
internet, those requests do match the rule:

8 block in quick on ex0 from any to

According to, the rules should
apply in this order: "interface --> NAT --> filter --> OS --> filter --> NAT
--> interface"

I've been snooping on ex0 for 10/8 traffic using tcpdumps rule: tcpdump -n -i
ex0 'net'.

It didn't show any rules when I pinged from A to the internet.

So the interface shouldn't even be seeing any of the traffic. 

ipf.conf is on
ipnat.conf is on

I use NetBSD 1.6.2_STABLE, 
ipf: IP Filter: v4.1.3 (396)
Kernel: IP Filter: v4.1.3
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 0
Feature mask: 0x10a

So my question is, why is the traffic blocked when I use that rule ?
Any help is greatly appreciated!


Er was eens een boer. Hij had 3 koeien, 2 witte en 1 witte.
Maar dat gaf niet, want de koe gaf ook niet.  De boer vond een 
horloge, de koe vond van niet.  Ra-ra kameel politiepet.