Re: kern/38773: ipf/ipnat broken in 4.99.63

[Paul Goyette <paul%whooppee.com@localhost>]

The following reply was made to PR kern/38773; it has been noted by GNATS.

From: Paul Goyette <paul%whooppee.com@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/38773: ipf/ipnat broken in 4.99.63
Date: Fri, 30 May 2008 05:42:01 -0700 (PDT)

 More info in an attempt to narrow things down...
 
 1. When the problem is occurring, a tcpdump shows no traffic in or
     out of the box.
 
 2. This is specific to ipnat.  Stopping ipnat via `/etc/rc.d/ipnat
     stop' lets things move, and previously-stalled network activity
     resumes.  Restarting ipnat brings the problem back immediately.
 
 3. The simplest way for me to cause the "hang" is to log in on a
     wsconsole and use `ls /home/paul' (where /home is NFS-mounted
     from a remote system on the "public network" - see diagram below).
 
 4. When the ls command hangs, running 'ps -owchan' from another
     session shows that ls is waiting for netio.
 
 5. The problem appears to affect only local traffic (ie, to or from
     the nat host itself).  Nat'd traffic works just fine.
 
 6. I'm still quite confused over how I can successfully nfs-mount
     the remote file system, yet once it is mounted I cannot do the
     'ls' command!  And some other stuff still works:
        * I can establish an ftp connection from the public network,
          and even transfer some data.
        * ICMP pings still work, even with a large packet size.
        * nntp traffic seems unaffected to multiple sources
 
 Since this seems to almost certainly be a problem with ipnat, here
 is my /etc/ipnat.conf file:
 
        map re0 192.168.2.0/25 -> 0/32 proxy port ftp ftp/tcp
        map re0 192.168.2.0/25 -> 0/32 portmap tcp/udp 40000:60000
        map re0 192.168.2.0/25 -> 0/32
 
                               +--------+
        Public Net        re0  |        | nfe0      Private Net
        <----------------------| SPEEDY |--------------------->
             66.92.186.133/29  |        | 192.168.2.250/24
                               +--------+
 
 The "private net" is divided into two halves, with the lower half
 (.0 through .127 - my VoIP gateway and several WiFi stations) being
 allowed to access the internet via nat and the upper half (.128
 through .255) being totally private (that's where my printer lives).