From nobody Tue Apr 21 14:38:47 2026 X-Original-To: freebsd-ipfw@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g0Q3B57lQz6WmTb for ; Tue, 21 Apr 2026 14:39:02 +0000 (UTC) (envelope-from bsd@connectedserver.com) Received: from mail.mailboxbox.com (mail.mailboxbox.com [195.154.48.128]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4g0Q393j1Vz49Wx for ; Tue, 21 Apr 2026 14:39:01 +0000 (UTC) (envelope-from bsd@connectedserver.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=connectedserver.com header.s=dkim header.b=nC4EkRDv; dmarc=none; spf=pass (mx1.freebsd.org: domain of bsd@connectedserver.com designates 195.154.48.128 as permitted sender) smtp.mailfrom=bsd@connectedserver.com Received: from mail.mailboxbox.com (localhost [127.0.0.1]) by mail.mailboxbox.com (Postfix) with ESMTP id 4g0Q380vltzDwsk for ; Tue, 21 Apr 2026 14:39:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d= connectedserver.com; h=x-mailer:to:date:message-id:subject :mime-version:content-transfer-encoding:content-type:from; s= dkim; t=1776782338; x=1777646339; bh=A77bTnlC5grwrGR2+bjnDidrSwf Snr3YpnIFxhZflF8=; b=nC4EkRDvKCQRLyTzcFWV9TDaxaOhwnYlvYyzb8a3M3q BM+opScKyQgfl/O2Y0sTOI7BAKaSnVdGRQdzXMXck9BEQTLvb+drE+VGfAA0LN19 qfU56UOTnRmThhvP/ecLHRvSfO3btUVtawgZoRNcdqxVFvCd1rYMsXzDA7YbFs00 = X-Virus-Scanned: amavis at mail.mailboxbox.com Received: from mail.mailboxbox.com ([127.0.0.1]) by mail.mailboxbox.com (mail.mailboxbox.com [127.0.0.1]) (amavis, port 10026) with ESMTP id OMvwFaL2Yszv for ; Tue, 21 Apr 2026 14:38:58 +0000 (UTC) Received: from smtpclient.apple (216-244-98-95.ftth.glasoperator.nl [95.98.244.216]) by mail.mailboxbox.com (Postfix) with ESMTPSA id 4g0Q3609KwzDxY8 for ; Tue, 21 Apr 2026 14:38:57 +0000 (UTC) From: Rob Bloemers Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable List-Id: IPFW Technical Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-ipfw List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-ipfw@FreeBSD.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.400.21\)) Subject: NAT problems 14.3+ Message-Id: <27FFB189-7608-4A97-AD87-21EC64CBC975@connectedserver.com> Date: Tue, 21 Apr 2026 16:38:47 +0200 To: freebsd-ipfw@freebsd.org X-Mailer: Apple Mail (2.3864.400.21) X-Spamd-Result: default: False [-3.50 / 15.00]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.998]; R_DKIM_ALLOW(-0.20)[connectedserver.com:s=dkim]; R_SPF_ALLOW(-0.20)[+mx]; MIME_GOOD(-0.10)[text/plain]; DKIM_TRACE(0.00)[connectedserver.com:+]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; RCVD_TLS_LAST(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; DMARC_NA(0.00)[connectedserver.com]; FREEFALL_USER(0.00)[bsd]; RCVD_VIA_SMTP_AUTH(0.00)[]; ARC_NA(0.00)[]; TO_DN_NONE(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; ASN(0.00)[asn:12876, ipnet:195.154.0.0/16, country:FR]; PREVIOUSLY_DELIVERED(0.00)[freebsd-ipfw@freebsd.org]; MID_RHS_MATCH_FROM(0.00)[]; MLMMJ_DEST(0.00)[freebsd-ipfw@freebsd.org]; APPLE_MAILER_COMMON(0.00)[]; MIME_TRACE(0.00)[0:+] X-Rspamd-Queue-Id: 4g0Q393j1Vz49Wx X-Spamd-Bar: --- I seem to have issues with i think something trivial like a simple NAT = on freebsd higher then 14.3. I have a machine with a public interface, which i put in a bridge to = share with jails to use public ip addresses. And a private bridge for = internal LAN (10.10.2.0/24, 10.10.2.1 configured on the bridge) of some = jails. With this ipfw rules set ``` #!/bin/sh # Flush out the list before we begin. ipfw -q -f flush # Set rules command prefix cmd=3D"ipfw -q add" wanif=3D"ice0" lanif=3D"bridge9" lannet=3D"10.10.2.0/24" ipfw table badhosts create type addr ipfw table goodhosts create type addr ipfw table goodhosts add 123.123.123.123 # No restrictions on Loopback Interface $cmd 00001 allow all from any to any via lo0 # No restrictions on LAN Interface $cmd 00008 allow all from any to any via $lanif=20 # Configure NAT-WAN interface ipfw -q nat 1 config if $wanif log reset same_ports=20 # Check inbound traffic for redirections $cmd 00006 nat 1 ip from any to me in via $wanif $cmd 50 deny all from "table(badhosts)" to any # Allow dynamic rules table connections $cmd 00101 check-state # NAT Lan traffic: $cmd 00104 skipto 1000 tcp from $lannet to any out via $wanif keep-state $cmd 00105 skipto 1000 tcp from $lannet to any out via $wanif setup = keep-state $cmd 00106 skipto 1000 udp from $lannet to any out via $wanif keep-state $cmd 00107 skipto 1000 icmp from $lannet to any out via $wanif = keep-state # -- Host Traffic -- # Allow access to public DNS # DNS TCP $cmd 00201 allow tcp from any to any 53 out via $wanif setup keep-state $cmd 00202 allow tcp from any to any 853 out via $wanif keep-state # DNS UDP $cmd 00203 allow udp from any to any 53 out via $wanif keep-state # Allow outbound ANY connections $cmd 00299 allow tcp from me to any out via $wanif setup keep-state # Allow outbound ping $cmd 00500 allow icmp from me to any out via $wanif keep-state # Allow outbound NTP $cmd 00501 allow udp from me to any 123 out via $wanif keep-state # Allow outbound SSH $cmd 00680 allow tcp from me to any 22 out setup keep-state # Allow inbound public pings $cmd 00700 allow icmp from any to me in via $wanif $cmd 800 allow all from "table(goodhosts)" to any $cmd 810 allow all from any to "table(goodhosts)" # Deny and log all other outbound connections $cmd 00900 deny log all from any to any out # NAT outbound traffiC $cmd 01000 nat 1 ip from any to any out via $wanif keep-state $cmd 01003 allow ip from any to any $cmd 12900 deny log all from any to any out ``` /etc/rc.conf ``` hostname=3D"probably.doing.something.wrong.tld" ifconfig_ice0=3D"DHCP" ifconfig_ice0_ipv6=3D"inet6 accept_rtadv" cloned_interfaces=3D"bridge0 bridge9" ifconfig_bridge0=3D"addm ice0 up" ifconfig_bridge9=3D"inet 10.10.2.1 netmask 255.255.255.0 up" sshd_enable=3D"YES" ntpd_enable=3D"YES" ntpd_sync_on_start=3D"YES" moused_nondefault_enable=3D"NO" # Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable dumpdev=3D"NO" zfs_enable=3D"YES" firewall_enable=3D"YES" firewall_script=3D"/etc/ipfw.rules" firewall_logging=3D"YES" firewall_logif=3D"YES" ipfw_nat_load=3D"YES" gateway_enable=3D"YES" ``` added to default /boot/loader.conf ``` ipfw_load=3D"YES" ipfw_nat_load=3D"YES" ``` Then i create a jail in this case with iocage. ``` iocage create -r 14.3-RELEASE -n test-jail iocage set vnet=3Don test-jail iocage set bpf=3Don test-jail iocage set boot=3Don test-jail iocage set defaultrouter=3D10.10.2.1 test-jail iocage set dhcp=3Dnone test-jail iocage set interfaces=3D"vnet0:bridge9" test-jail iocage set ip4_addr=3D"vnet0|10.10.2.101/24" test-jail ``` And this works fine. icmp/udp/tcp it all works as expected, and how i = have been since quite a few versions of FreeBSD Then i noticed the 14.3 EOL warning a week ago, and i figured lets = upgrade. But after the upgrade my NAT no longer functions as expected = with 14.4. And it's been keeping me busy since. icmp still works, udp (dns) too, though i need to change from the ISP = dns to 1.1.1.1 (which is a bit odd). But tcp nothing seems to work = anymore. ipfw -d show at this point does show my outgoing tcp connection, but = inside the jail it times out. 15.0-RELEASE (15.0 jail) with these settings behave even stranger, = problematic i would say. Because with the rc.conf/ipfw rules loaded = (that i have been using for many versions), ipfw seems to starts = 'looping' packets as soon as i send out a packet from the jail be it a = dns lookup or a fetch http://ip. And this renders the machine = unavailable and i have to power cycle it.=20 If anybody can shed a light on what changed, what i'm doing wrong, i'd = highly appreciate it. And if i need to provide any more information i'll = gladly do so. (i have try a ton of settings, and other firewall = rulesets, even from the bsd manual for NAT, but no success) Kind Regards Rob=