kern/129036: [ipfw] 'ipfw fwd' does not change outgoing interface
eugen at eg.svzserv.kuzbass.ru
Thu Nov 20 21:10:02 PST 2008
>Synopsis: [ipfw] 'ipfw fwd' does not change outgoing interface name
>Arrival-Date: Fri Nov 21 05:10:01 UTC 2008
>Originator: Eugene Grosbein
>Release: FreeBSD 6.3-STABLE i386
Svyaz Service JSC
System: FreeBSD eg.svzserv.kuzbass.ru 6.3-STABLE FreeBSD 6.3-STABLE #4: Fri Aug 15 14:42:33 KRAST 2008 eugen at eg.svzserv.kuzbass.ru:/usr/local/obj/usr/local/src/sys/EG i386
"ipfw fwd" rules commonly used to implement policy-based routing.
Very often they are used to change outgoing interface for packet.
For incoming packet, "ipfw fwd" changes next-hop but fails
to change outgoing interface name if it changes with new next-hop
Assume a packet from 10.0.0.1 comes in via em0 and according to
routing table should be forwarded via em1.
When another router 192.168.0.1 is directly connected through em2:
ipfw add 1000 fwd 192.168.0.1 ip from 10.0.0.0/8 to any in recv em0
ipfw add 2000 divert 5000 ip from any to any out xmit em1
Our packet is matched by rules 1000, so it's next-hop is changed
to 192.168.0.1 and it will really go out em2. But at second
ipwf rulest pass it is matched with rules 2000 to.
That's really bad - packet is passed to userland application
or netgraph mode listening on divert port 5000 but it must not.
With some care, ipfw ruleset may be changed to workaroung
the problem but real fix is needed - kernel should correct
name of ougoing interface for such cases so ipfw won't make mistakes.
More information about the freebsd-bugs