>Number:         25971
>Category:       kern
>Synopsis:       ipfilter syntax for allowing NAT'd packets no longer works in ipf4
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jun 19 15:52:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     grant beattie
>Release:        NetBSD 2.0_BETA
>Organization:
>Environment:
System: NetBSD gw 2.0_BETA NetBSD 2.0_BETA (_gw_) #0: Sat Jun 19 14:52:27 EST 2004 grant@mofo:/data1/netbsd/netbsd-2-0/src/sys/arch/i386/compile/_gw_ i386
Architecture: i386
Machine: i386
>Description:
consider the following ipnat rule:

rdr rtk0 192.168.1.1/32 port 53 -> 192.168.1.25 port 53 tcp

in ipfilter 3.4, the destination address in filter rules is the
address after NAT is applied:

pass in quick on rtk0 proto tcp from any to 192.168.1.25 port = 53

but in 2.0_BETA, the ipfilter rule needs to use the address *before*
NAT is applied for the rule to match:

pass in quick on rtk0 proto tcp from any to 192.168.1.1 port = 53

>How-To-Repeat:
migrate such a configuration from ipf 3.4 to ipf 4.1.
>Fix:
unknown.
>Release-Note:
>Audit-Trail:
>Unformatted: