Hi!
I am sorry for the delay but I still think this must be a bug somewhere.
My first pass rules apply because they are 'quick' and because i see
traffic also in pflogs. And without changing anything in packet filter
and only changing ip aadresses so that computer behind firewall does not
match with firewall's internet facing side, everythins starts to work
(and with this workaround i went).
Best regards,
Imre
Hi Imre,
Not sure you've got a reply to this (I was going through unread mail
on bugs@), but your "pass all flags" rule is a last match thus neither
of the other pass rules are taken into account.
Cheers,
Mike
On 28 May 2016 at 00:20, <i...@auul.pri.ee> wrote:
Hi!
I think i stumbed onto a bug related to using in combination rdomain,
specific set on ip aadresses and pf doing nat-to.
I have OpenBSD v. 5.9 installed from .iso, not patches applied and not
special programs insalled or running
# uname
OpenBSD obsd59.auul 5.9 GENERIC#1761 amd64
In my setup OpenBSD acts as a firwall, it has two network interfaces,
one
faceing internet and another internal network.
vio0 (rdomain 0): 192.168.1.146 and vlan11, internet side
vio1 (rdomain 100): 192.168.1.254 and vlan10, intranet side
in rdomain 0 gateway is 192.168.1.254
in rdomain 100 no gateway is set
computer behind OpenBSD in rdomain 100 (and vlan10) has ip address
192.168.1.146 and gw 192.168.1.254.
OpenBSD ruleset is essentially
# pfctl -sr
pass in log quick on vio1 inet from 192.168.1.0/24 to any flags S/SA tag
FROM_INTRANET rtable 0
pass out log quick on vio0 inet all flags S/SA tagged FROM_INTRANET
nat-to
192.168.1.146
pass all flags S/SA
Now, when sending packets from computer behind this OpenBSD firewall
thru it
tcp connections aint established, for some reason OpenBSD rejects
incoming
syn-ack packets
# tcpdump -ni vio0 port 873
tcpdump: listening on vio0, link-type EN10MB
00:40:34.231363 192.168.1.146.60895 > 10.80.123.154.873: S
233483646:233483646(0) win 29200 <mss 1460,sackOK,timestamp 7512261
0,nop,wscale 6> (DF)
00:40:34.240835 10.80.123.154.873 > 192.168.1.146.60895: S
344980263:344980263(0) ack 233483647 win 28960 <mss
1460,sackOK,timestamp
174805425 7512261,nop,wscale 7> (DF)
00:40:34.240937 192.168.1.146.60895 > 10.80.123.154.873: R
233483647:233483647(0) win 0 (DF)
If i change computer's address behind OpenBSD different from the vio0
address, say 192.168.1.144, then packets get thru OpenBSD. I wonder if
this
is a bug or still i am doing something wrong.
You may wonder why this kind of ugly setup is useful. It is not designed
from the ground up like this. It is just so to say 'OpenBSD to the
rescue'
to get one legacy system connected to the internet more-or-less
controlled
way. In that legacy system ip config cant be changed so OpenBSD is
placed in
between the legacy system and the rest of the network and it is doing
this
strange mapping.
Best regards,
Imre
