Hi list,
I upgraded my Firewall to RELENG_6,
the Firewall does NAT for an RFC1918 net, and the relevant part of the
ruleset looks like this:
nat on $ext_if from $internal_net to any -> ($ext_if)
pass in on $int_if from {$internal_net, 224.0.0.0/4} to any keep state
allow-opts
pass out on $int_if from any to {$internal_net, 224.0.0.0/4} keep state
allow-opts
pass out on $ext_if proto { tcp, udp } all keep state
With RELENG_5 ICQ from the hosts on the RFC1918 network worked, but now
they are not able to connect to the ICQ
Server.
The logged traffic on pflog0 looks like this:
17:45:25.966685 IP (tos 0x0, ttl 62, id 63506, offset 0, flags [DF],
proto: TCP (6), length: 60) 192.168.1.24.49231 > 205.188.7.248.5190: S
920618149:920618149(0) win 65535 <mss 1460,nop,wscale 0,[|tcp]>
17:45:28.871854 IP (tos 0x0, ttl 62, id 63512, offset 0, flags [DF],
proto: TCP (6), length: 60) 192.168.1.24.49231 > 205.188.7.248.5190: S
920618149:920618149(0) win 65535 <mss 1460,nop,wscale 0,[|tcp]>
17:45:31.872076 IP (tos 0x0, ttl 62, id 63515, offset 0, flags [DF],
proto: TCP (6), length: 60) 192.168.1.24.49231 > 205.188.7.248.5190: S
920618149:920618149(0) win 65535 <mss 1460,nop,wscale 0,[|tcp]>
17:45:34.874595 IP (tos 0x0, ttl 62, id 63518, offset 0, flags [DF],
proto: TCP (6), length: 44) 192.168.1.24.49231 > 205.188.7.248.5190: S,
cksum 0x7097 (correct), 920618149:920618149(0) win 65535 <mss 1460>
17:45:37.874576 IP (tos 0x0, ttl 62, id 63520, offset 0, flags [DF],
proto: TCP (6), length: 44) 192.168.1.24.49231 > 205.188.7.248.5190: S,
cksum 0x7097 (correct), 920618149:920618149(0) win 65535 <mss 1460>
Anyone got an idea, why this traffic doesn't match the pass rules
anymore?
regards
tilman
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
