https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=283730
Bug ID: 283730
Summary: Route table (fib) not checked for incoming packet for
IP assigned to interface in different fib
Product: Base System
Version: 14.2-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
I've got the following setup:
- ix0 (192.168.1.1/24) in fib 0
- ix1 (172.16.100.1/24) in fib 1
I would expect that when pinging from 192.168.1.2 to 172.16.100.1 that the
packet would get dropped because there is no route in the route table for fib 0
to fib 1.
However:
% ping 172.16.100.1
PING 172.16.100.1 (172.16.100.1): 56 data bytes
64 bytes from 172.16.100.1: icmp_seq=0 ttl=64 time=8.360 ms
64 bytes from 172.16.100.1: icmp_seq=1 ttl=64 time=10.080 ms
^C
--- 172.16.100.1 ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 8.360/9.220/10.080/0.860 ms
# setfib 0 netstat -rn -4
Routing tables
Internet:
Destination Gateway Flags Netif Expire
127.0.0.1 link#7 UH lo0
192.168.1.0/24 link#9 U vlan10
192.168.1.1 link#7 UHS lo0
# setfib 1 netstat -rn -4
Routing tables (fib: 1)
Internet:
Destination Gateway Flags Netif Expire
127.0.0.1 link#7 UHS lo0
172.16.100.0/24 link#25 U ix1
172.16.100.1 link#7 UHS lo0
This creates an issue with my more complicated setup where I have two separate
WAN interfaces with 0/0 routes for each:
- vlan4088 - WAN 01 (192.0.2.5/24) - fib 0 has 0/0 route
- vlan10 - 192.168.10.1/24 - fib 0
- vlan4087 - WAN 02 (198.51.100.10/24) - fib 1 has 0/0 route
- vlan20 - 192.168.20.1/24 - fib 1
The goal here is to have traffic from vlan 10 always exit vlan4088, and traffic
from vlan 20 always exit vlan 4087.
With the explicit goal that if traffic from vlan 10 needs to be routed to
198.51.100.10 it goes out vlan4088 -> internet -> vlan4087 interface.
This works correctly from the FreeBSD router itself:
setfib 0 traceroute 198.51.100.10
Will correctly follow the 0/0 route out WAN 01 -> internet and packets will hit
vlan4087 as an interface and get processed correctly.
Vice-versa works as well:
setfib 1 traceroute 192.0.2.5
Follows the 0/0 route in fib 1 to go WAN 02 -> internet -> vlan4088.
However a device sitting on VLAN 10 that wants to run traceroute to
198.51.100.10 will show that it is a single hop.
% traceroute 198.51.100.10
traceroute to 198.51.100.10 (198.51.100.10), 64 hops max, 40 byte packets
1 198.51.100.10 (198.51.100.10) 6.243 ms 4.197 ms 3.829 ms
This is off course unexpected, since VLAN 10 is not in the same FIB as VLAN
4087 and there is no route there.
--
You are receiving this mail because:
You are the assignee for the bug.
