Subject: Re: nat on alpha
To: Ross Harvey <>
From: nm <>
List: port-alpha
Date: 03/05/1998 15:49:59
At 11:07 AM 3/5/98 -0800, you wrote:
>I don't usually run it but I'd be happy to fix it if it's broken.
>What's wrong with it?

its great to see that someone is interested in it!  i have de0 and
de1 on my alpha and de0 is and de1

tcp and udp to not seem to work but icmp (pings) work fine.
tcp and udp packets do get thur the gateway machine and appear
to be destined for the right internal host but something about 
them must be malformed because the internal host ignores them :(

now as far as details go, i have an older post i posted to the openbsd
list (openbsd/2.2 seems to have the same problem).  ill attach that
little info sheet at the end of this message.

im going out of town for spring break but will be back
on the 16th (monday) and i can work on getting you some more up to
date stats and a better bug report

thank you for your time
nick maniscalco

here is some info on the problem:
a little diagram of the network(s):

   Internet   <I>----------<A>--------<B>

ok, now...

   ----   means ethernet segment...
   <I>    this is the main gateway to the internet
          its ip is

   <A>    this is my openbsd box, it has two ethernet
          cards, de0 and de1
          de0 is (class c)
          de1 is   (class c)

   <B>    this is my winnt box, it has one ethernet card
          with as the ip

from B i can ping A and anything on the internet...

now, if i run tcpdump -i de1 on A (the openbsd machine)
and try to do a name server look up from B, here is what
is shown:

21:09:45.867187 glacier.1165 > 1+ (29)
21:09:45.873046 > glacier.1165: 1* 1/5/5 (245)

ok, now glacier is box B and is the name server
out on the net somewhere...

from this its obvious that the information for the request for the 
lookup got to the name server and was processed and sent back...

you can also see that the result of that query did make it onto the
same network that B is on...

however B appears as if the request never made it and times out :(

--- how ipf is executed ---
ipf -Fa -f /etc/ipf.rules -E

--- how ipnat is executed ---
ipnat -CF -f /etc/nat.rules

--- ipnat -l right after boot up ---
# ipnat -l
List of active MAP/Redirect filters:
map de0  ->  portmap tcp/udp 10000:20000
map de0  ->

List of active sessions:

--- ipf.rules ---
# cat ipf.rules
pass in from any to any
pass out from any to any

--- nat.rules ---
# cat nat.rules
map de0 -> portmap tcp/udp 10000:20000
map de0 ->

--- ifconfig and route info ---
# ifconfig -A
lo0: flags=8009<UP,LOOPBACK,MULTICAST>
        inet netmask 0xff000000
        inet netmask 0xffffff00 broadcast
        inet netmask 0xffffff00 broadcast

# route -n show
Routing tables

Destination      Gateway            Flags
default        UG          UG          UH      link#2             U      0:0:c0:3e:ea:d     UH      link#1             U      0:0:c:7f:91:20     UH          UGH        link#1             U