Am 2013-11-23 16:32, schrieb Walter Haidinger: > Since moving to OpenBSD 5.4/i386, I noticed that I cannot ping > some hosts on my vlan2. tcpdump on the receiving machines show > icmp echo-requests having a bad checksum. > > I've managed to trace down the problem to the following pf rule: > match out quick on vlan2 from (vlan2:network) to any nat-to (vlan2) > > The checksum mangling only occurs to packets when the _own_ network > is natted, i.e. no nat or the following rule makes everything work: > match out quick on vlan2 from (vlan2:network) to ! (vlan2:network) nat-to > (vlan2) > So far, I've only found icmp packets (tried only icmp echo-requests) > to have bad checksums. No problems with tcp or udp traffic.
Unfortunately this isn't quite true. Well, only on the machine itself. However, NAT on any vlan seems to be broken with OpenBSD 5.4. Using the simple pf rules: match out on re0 from any to any nat-to (re0) pass in quick on vlan2 all Should enable NAT on vlan2 (parent is re0, states floating), right? Turns out it doesn't work at all (no outbound connection possible). If I use a non-vlan IP, there is no problem. Is this reproducible by someone? Best Regards, Walter
