NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: kern/53962 (npf: weird 'stateful' behavior)

The following reply was made to PR kern/53962; it has been noted by GNATS.

From: Timo Buhrmester <>
Subject: Re: kern/53962 (npf: weird 'stateful' behavior)
Date: Tue, 14 Apr 2020 04:07:50 +0200

 > > Does the "stateful-all" keyword (in -current/netbsd-9) satisfy your use case?
 > The short answer is no, or rather I don't know; something with the NAT seems broken.
 After some digging it seems that npf ties packet direction (in/out) to
 stream direction (forwards/backwards), which naturally fails when
 multiple interfaces are involved.  Maybe I'm misunderstanding things,
 but it fits the fact that the wrong address is being rewritten
 (in the mentioned testcase, rewriting >
 to > rather than to >
 Unrelatedly, I noticed that the order of groups in npf.conf matters.
 That is, if the "default" group is the first group in the file,
 the rules in the "default" group will apply to all packets regardless
 of more specific groups below.  This can be trivially worked around
 by putting the default group last, of course, but the documentation
 doesn't read as if this was intended behavior.

Home | Main Index | Thread Index | Old Index