kern/137346: ipfw nat redirect_proto is broken

Dmitriy Demidov dima_bsd at inbox.lv
Sun Aug 2 09:10:02 UTC 2009


>Number:         137346
>Category:       kern
>Synopsis:       ipfw nat redirect_proto is broken
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Aug 02 09:10:02 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Dmitriy Demidov
>Release:        FreeBSD 7.2-STABLE
>Organization:
>Environment:
FreeBSD hius.local.home 7.2-STABLE FreeBSD 7.2-STABLE #0: Sun Jul 19 13:01:10 EEST 2009     root at hius.local.home:/usr/obj/usr/src/sys/STABLE  i386
>Description:
Looks like redirect_proto in ipfw nat is broken.

I have NAT router with following config:
fxp0 - LAN (192.168.1.1)
em0 - WAN (8.9.0.100)

# ipfw show
00100 214 45088 allow ip from any to any via lo0
00200   0     0 deny ip from any to 127.0.0.0/8
00300   0     0 deny ip from 127.0.0.0/8 to any
00400   2   100 count ip from any to any
00500   0     0 allow ip from any to any via fxp0
00600   2   100 count ip from any to any
00700   2   100 nat 1 log logamount 100 ip from any to any via em0
00800   0     0 count ip from any to any
65535   0     0 deny ip from any to any

# ipfw nat 1 show
nat 1: icmp=0, udp=0, tcp=2, pptp=0, proto=0, frag_id=0 frag_ptr=0 / tot=2

# ipfw nat 1 show config
ipfw nat 1 config log redirect_proto tcp 192.168.1.2 8.9.0.100



On NAT router I don not have SSH daemon running. If I make a try to connect to 192.168.1.2 SSH (81.91.0.122 -> 8.9.0.100:22) from Internet via redirect_proto I got error:

tcpdump -i 2 -vvv -n -l ip
tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes
22:27:35.459508 IP (tos 0x0, ttl 64, id 51316, offset 0, flags [DF], proto TCP (6), length 60) 81.91.0.122.35654 > 8.9.0.100.22: S, cksum 0x6bc2 (correct), 2918273360:2918273360(0) win 5840 <mss 1460,sackO
K,timestamp 1743140 0,nop,wscale 6>
22:27:35.459638 IP (tos 0x0, ttl 64, id 298, offset 0, flags [DF], proto TCP (6), length 40) 8.9.0.100.22 > 81.91.0.122.35654: R, cksum 0x839f (correct), 0:0(0) ack 2918273361 win 0

So looks like redirect_proto do not works as expected here - it passes all incoming traffic into local machine (it do not alter destination IP address of packet as expected).
>How-To-Repeat:
Make a try to use redirect_proto in any ipfw nat configuration.
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted:


More information about the freebsd-bugs mailing list