kern/50676: icmp traceroute does not work on NetBSD 7 / IPFilter 5.1

[gergely%egervary.hu@localhost]

>Number:         50676
>Category:       kern
>Synopsis:       icmp traceroute does not work on NetBSD 7 / IPFilter 5.1
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jan 18 11:45:00 +0000 2016
>Originator:     Gergely EGERVARY
>Release:        7.0_STABLE
>Organization:
>Environment:
NetBSD galileo.poli.hu 7.0_STABLE NetBSD 7.0_STABLE (GALILEO) #0: Mon Jan 18 09:58:13 CET 2016  root%galileo.poli.hu@localhost:/usr/src/sys/arch/amd64/compile/GALILEO amd64

>Description:
ICMP-based traceroute (MTR, Windows tracert, etc.) does not work behind NAT on NetBSD-7

Traceroute only shows the first and the last hop.

- No ipf rules (pass all)
- Only one ipnat rule (NAT)
  map wm0 172.28.0.0/16 -> 193.225.174.20/32

Traceroute output:
Tracing route to index.hu [217.20.130.99]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  172.28.0.20
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     3 ms     2 ms     3 ms  index.hu [217.20.130.99]

Trace complete.

>How-To-Repeat:
traceroute via ICMP

>Fix: