kern/98184: ipfw add pass 224.0.0.0/4 multicast rule prevents natd
forwarding for dynamic rules
Steven Baker
msbaker at cs.uoregon.edu
Tue May 30 18:20:15 PDT 2006
>Number: 98184
>Category: kern
>Synopsis: ipfw add pass 224.0.0.0/4 multicast rule prevents natd forwarding for dynamic rules
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed May 31 01:20:13 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator: Steven Baker
>Release: FreeBSD 6.0 RTM kernel build with some components removed and others added
>Organization:
>Environment:
FreeBSD firewall 6.0-RELEASE-p3 FreeBSD 6.0-RELEASE-p3 #0: Sun Jan 22 22:34:41 PST 2006 root at firewall:/usr/obj/usr/src/sys/FIREWALL601 i386
>Description:
I have a subset of IPFW rules that deal questionable IP addresses. I have been using these same rules on FreeBSD firewalls since probably FreeBSD 3.1.
The rules in question are as follows where:
oif = the outside network interface
iif = the internal network interface
inet = the internal network (192.168.0.0, for example)
imask = the internal network mask (255.255.255.0, for example)
# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
# Stop Class D
${fwcmd} add deny log all from any to 224.0.0.0/4 via ${oif}
# Stop Class E
${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
This same block of rules is repeated before and after the NATD rule
I also have a set of rules after the NATD rule to allow DNS queries to a bunch of known DNS servers:
# Allow DNS queries out to our primary DNS Servers, all from firewall
${fwcmd} add pass udp from any to ${dns1} 53 keep-state
${fwcmd} add pass udp from any to ${dns2} 53 keep-state
etc ...
Because of some other issues, I changed the Class D rule to allow multicast packets both before and after NATD.
# Allow Class D
${fwcmd} add pass log all from any to 224.0.0.0/4 via ${oif} keep-state
I also added the following rule after NATD
${fwcmd} add pass log all from ${inet}${imask} to 224.0.0.0/4 via ${iif}
keep-state
Once these changes were made, dns queries from the firewall machine worked but all dns queries from behind the firewall failed. TCP connections to
an external IP address (http://72.5.124.61 which is www.sun.com) would still work and traverse the firewall/gateway. But the DNS queries/responses did not appear to traverse the firewall/gateway. My best guess not looking at the source code is that having an allow rule for multicast D addresses with keep-state somehow interfered with the DNS queries keep-state rules and the dynamic rules that were created.
After issuing an nslookup from a client machine behind the firewall, I could see that an appropriate dynamic rule was created using "ipfw -ad show" (output not enclosed).
In troubleshooting, I added a rule at the beginniing of the ruleset so that I would see all packets:
ipfw add 333 count log all ip from any to any
>From the firewall log (note I have replaced addresses with symbolic names)
nslookup request from firewall machine that works:
May 30 11:00:52 firewall kernel: ipfw: 333 Count UDP ${oip}:60915 ${dns1}:53 out via ${oif}
May 30 11:00:53 firewall kernel: ipfw: 333 Count UDP ${dns1}:53 192.168.186.
1:60915 in via ${oif}
nslookup from behind firewall machine that fails
May 30 10:59:51 firewall kernel: ipfw: 333 Count UDP ${client1}:1066 ${dns1}:53 in via ${iif}
Note that there were no multicast packets logged. Just changing the rule appears to cause this problem.
>How-To-Repeat:
Add the following rules on a firewall machine running FreeBSD 6.0 using natd and ipfw2
# Allow Class D
${fwcmd} add pass log all from any to 224.0.0.0/4 via ${oif} keep-state
${fwcmd} add pass log all from ${inet}${imask} to 224.0.0.0/4 via ${iif}
keep-state
This machine should also have some rules to allow queries to known name servers after the NATD rule and the above rules:
# Allow DNS queries out to our primary DNS Servers, all from firewall
${fwcmd} add pass udp from any to ${dns1} 53 keep-state
${fwcmd} add pass udp from any to ${dns2} 53 keep-state
etc ...
Try a dns query from behind the firewall machine and it should fail.
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-bugs
mailing list