[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: kern/53962 (npf: weird 'stateful' behavior)
The following reply was made to PR kern/53962; it has been noted by GNATS.
From: Timo Buhrmester <fstd.lkml%gmail.com@localhost>
Cc: tech-net%netbsd.org@localhost, rmind%netbsd.org@localhost
Subject: Re: kern/53962 (npf: weird 'stateful' behavior)
Date: Tue, 14 Apr 2020 04:07:50 +0200
> > Does the "stateful-all" keyword (in -current/netbsd-9) satisfy your use case?
> The short answer is no, or rather I don't know; something with the NAT seems broken.
After some digging it seems that npf ties packet direction (in/out) to
stream direction (forwards/backwards), which naturally fails when
multiple interfaces are involved. Maybe I'm misunderstanding things,
but it fits the fact that the wrong address is being rewritten
(in the mentioned testcase, rewriting 188.8.131.52 > 192.168.1.200
to 192.168.1.200 > 192.168.1.200 rather than to 184.108.40.206 > 192.168.3.2.
Unrelatedly, I noticed that the order of groups in npf.conf matters.
That is, if the "default" group is the first group in the file,
the rules in the "default" group will apply to all packets regardless
of more specific groups below. This can be trivially worked around
by putting the default group last, of course, but the documentation
doesn't read as if this was intended behavior.
Main Index |
Thread Index |