ipfilter/ipnat 3.4.35 and udp-traceroute problem
pawmal-posting at freebsd.lublin.pl
Thu Aug 5 15:55:51 PDT 2004
Can anobody here confirm that newest 3.4.35 IPFilter in RELENG_4 works with
no problems when IPNATing traceroute UDP (+ICMP response) packets?
I can see weird behavior of this command:
traceroute -s privateIP -P UDP dst
Outgoing UDP packets are translated, ICMP time-exceded message comes back,
but traceroute shows '* * *'. ;)
traceroute -s privateIP -P ICMP dst
traceroute -s privateIP -P TCP dst
are working OK.
UDP protocol is _not_ filtered.
Also `traceroute -s publicIP -P UDP dst' works just fine. State table was
flushed and has low number of mappings:
mapped in 167718594 out 162841788
added 4480473 expired 4466531
no memory 0 bad nat 375052 <- hm
inuse 2259 <=
Mapping rules (for this uplink and this privateIP) are quite common:
map rl0 privateIP/20 -> publicIP/32 proxy port ftp ftp/tcp
map rl0 privateIP/20 -> publicIP/32 portmap tcp/udp auto
map rl0 privateIP/20 -> publicIP/32
(/20 is big, but network is smaller, don't be scared).
This ruleset was used for months with no problems. Kernel is almost GENERIC.
Another interesting thing:
% ipf -V
ipf: IP Filter: v3.4.31 (336) <=
Kernel: IP Filter: v3.4.35
% grep -i ver /usr/src/contrib/ipfilter/ipl.h
#define IPL_VERSION "IP Filter: v3.4.31"
Newer ipl.h sits happily in vendor branch.
More information about the freebsd-net