Subject: IPfilter blocking on the wrong interface?
To: None <firstname.lastname@example.org>
From: Wouter Schoot <email@example.com>
Date: 09/27/2004 14:06:02
Hello all listreaders,
I'm using ipfilter on my netbsd machine to take some control over the flows,
and I stumbled into a weird problem lately.
Here's the situation:
|A| ===== |B| ==> Internet
Computer A is on an internal, local subnet. It has IP adres 10.0.0.33.
Computer B has two nics, one is ex1, with IP 10.0.0.1, and the other is ex0
with (internet) ip address 126.96.36.199 (Yes, the same ip that hosts the
NetBSD 2.0 beta iso's: http://netbsd.student.utwente.nl/NetBSD-2.0_RC1-iso/).
This is your average NAT setup, I figured:
map ex0 10.0.0.33/32 -> 0/32 proxy port ftp ftp/tcp
map ex0 10.0.0.33/32 -> 0/32 portmap tcp/udp 40000:60000
map ex0 10.0.0.33/32 -> 0/32
Take the following line:
block in quick on ex0 from any to 10.0.0.0/8
I put it there to prevent the outer networkcard (connected to the internet)
from packets destinated for internal networks. I figured, they should not
end up at my external interface.
But here's the catch. When I have that block rule enabled, machine A can't
connect to the internet anymore. Connecting to 10.0.0.1 goes fine, but no
When I 'ipfstat -hi' with the rule enabled, and ping some on A to the
internet, those requests do match the rule:
8 block in quick on ex0 from any to 10.0.0.0/8
According to http://www.phildev.net/ipf/IPFques.html#11, the rules should
apply in this order: "interface --> NAT --> filter --> OS --> filter --> NAT
I've been snooping on ex0 for 10/8 traffic using tcpdumps rule: tcpdump -n -i
ex0 'net 10.0.0.0/8'.
It didn't show any rules when I pinged from A to the internet.
So the interface shouldn't even be seeing any of the 10.0.0.0/8 traffic.
ipf.conf is on http://ascent.student.utwente.nl/~ascent/ipf.conf
ipnat.conf is on http://ascent.student.utwente.nl/~ascent/ipnat.conf
I use NetBSD 1.6.2_STABLE,
ipf: IP Filter: v4.1.3 (396)
Kernel: IP Filter: v4.1.3
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 0
Feature mask: 0x10a
So my question is, why is the traffic blocked when I use that rule ?
Any help is greatly appreciated!
Er was eens een boer. Hij had 3 koeien, 2 witte en 1 witte.
Maar dat gaf niet, want de koe gaf ook niet. De boer vond een
horloge, de koe vond van niet. Ra-ra kameel politiepet.