route-to being ignored?

Jason DiCioccio jd at ods.org
Tue Oct 3 17:10:48 PDT 2006


> Jason DiCioccio wrote:
>> Greetings,
>>   I'm having a bit of an issue here with pf and the route-to statement
>> on
>> 6.1-RELEASE-p3/i386.
>>
>>
>>   Basically, I have the following rule (at the top of my rules, no
>> less):
>>
>> pass out quick route-to ( tun0 10.8.1.5 ) from 66.29.58.71/32 to any
>>
>>   I've tried this rule with keep state, without keep state, with quick,
>> without quick, basically everything I could think of.  And I haven't
>> been able to get this to do anything at all.  Traffic is still flowing
>> out of ng0 (where the default route resides).
>>
>>   66.29.58.71 is an IP bound to lo0 on the server.  Traffic for it comes
>> in over tun0, for which the ifconfig follows:
>>
>> tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
>>         inet6 fe80::24a7:3207:1aa1:c985%tun0 prefixlen 64 scopeid 0xa
>>         inet 10.8.1.6 --> 10.8.1.5 netmask 0xffffffff
>>         Opened by PID 347
>>
>>   Currently if I do a tcpdump on ng0, I can see the ICMP Echo replies
>> going back out over ng0 while the requests come in over tun0.  I should
>> also note that I haven't been able to get this working with ipfw fwd
>> either.
>>
>>   options IPFIREWALL_FORWARD is in the kernel config as well.
>>
>>   Anyone have any idea what I'm missing?
>
> If the traffic is coming in on tun0 then you probably want reply-to not
> route-to.

Sorry, I should've mentioned that I've tried this too.  It's possible that
I did it wrong, but I did variations of this:

pass in quick on tun0 reply-to ( tun0 10.8.1.5 ) from any to
66.29.58.71/32 keep state

If I'm doing this wrong, let me know.

Regards,
-JD-



More information about the freebsd-pf mailing list