misc/90386: pfctl -s labels don't count bytes if labeled rule was
den2208 at yandex.ru
Wed Dec 14 04:50:05 PST 2005
>Synopsis: pfctl -s labels don't count bytes if labeled rule was NATted
>Arrival-Date: Wed Dec 14 12:50:02 GMT 2005
>Originator: Denis Grinchuk
FreeBSD free54.newintech.com. 5.4-RELEASE FreeBSD 5.4-RELEASE #0: Mon Nov 7 15:41:11 MSK 2005 root at free53.newintech.com.:/usr/src/sys/i386/compile/mykernel2 i386
My machine is firewall and proxy-server. I need to count forwarding traffic from Internet (inbound only). Firewall - pf with nat (I have one real IP).Counter based on pf labels. NAT working on extenal interface like this (I simplify):
nat on $ext_if from $INT_NET to any -> $EXT_IP
pass out on $ext_if from $EXT_IP to any
pass in on $ext_if from any to $EXT_IP label "$dstaddr:external"
pass in on $int_if from $INT_NET to !<private>
pass out on $int_if from !<private> to $INT_NET label "$dstaddr:internal"
Counters at internal interface working well, but external show zero bytes:
#pfctl -s labels
192.168.0.0/24:internal 111 10 10000
188.8.131.52:extenal 111 0 0
I.e. hits was, but bytes wasn't counted for nat'ted backward packets.
Sorry for my English. Thank you for FreeBSD!
More information about the freebsd-bugs