SynProxy had a trouble when located front of a router device

[Tugrul Erdogan]

I have important founding. I think it is about VLAN between FreeBSD-Router
in diagram.

While Attacker-FreeBSD connection is normal IP connection, FreeBSD-Router
connection was tagged VLAN 159.
While FreeBSD-Router connection is VLAN based, synproxy rule State
Creations value increase, synproxy sends ACKS to the Attacker.
However synproxy replay with original server does not working ( The routing
rule counter on os routing table which redirect packets to FreeBSD-Router
side is increasing but the packet can not be created  ).
When I change FreeBSD-Router connection to normal IP connection without
VLAN, it starts to working.

What can be the problem and solution?




On Thu, Oct 23, 2014 at 9:36 PM, Tugrul Erdogan <h.tugrul.erdogan at gmail.com>
wrote:

> Update:
>
> The topololgy has been redrawed below:
>
>
> | Atacker | <-> | FreeBSD | <-> | Router | <-> | Victim |
>
>
> Thanks,
>
>
> PS: Although connections lost by pf synproxy, the pings (form attacker to
> victim) can succesfully returns.
>
>
>
>
> On Thu, Oct 23, 2014 at 9:25 PM, Tugrul Erdogan <
> h.tugrul.erdogan at gmail.com> wrote:
>
>> Hi,
>>
>> I have a trouble at pf synproxy state handshakıng mechanism. I have been
>> using pf for years, but first time I have  a router at the backpane of
>> topology. The schema of my topology given below:
>>
>> ---------------------                        ---------------------------
>>                    -------------------         ----------------------
>>
>> Attacker                <---------->       FreeBSD(Test)
>>  <----------->    Router          <---->    Victim
>>
>> -------------------                          ---------------------------
>>                      -----------------             -------------------
>>
>> I am trying to connect from attacker to the victim from port 80. Without
>> synproxy rule I have successfully conneting. Whenever I activate synproxy
>> state, the client(attacker) side handshaking completing (the outer
>> interface of FreeBSD device)
>>
>> 21:09:53.531421 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [S], seq
>> 1458776780, win 5840, options [mss 1460,sackOK,TS val 1336836512 ecr
>> 0,nop,wscale 7], length 0
>> 21:09:53.531494 IP AA.BB.189.100.80 > AA.BB.183.93.51510: Flags [S.], seq
>> 2093170245, ack 1458776781, win 0, options [mss 1460], length 0
>> 21:09:53.531524 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ack
>> 1, win 5840, length 0
>> 21:09:56.533680 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ack
>> 1, win 5840, length 0
>> 21:10:02.532255 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ack
>> 1, win 5840, length 0
>>
>> after that the  "pfct -vvss" showing:
>>
>> ix1 tcp AA.BB..183.93:51513 -> AA.BB..189.100:80       PROXY:DST
>>
>> and there is no package at inner interface of FreeBSD device at the
>> result of tcpdump. After some seconds FreeBSD generates RST package both
>> side. (There is no handshake SYN or ACK packages generated by pf synproxy
>> at the inner interface)
>>
>> I think that the problem is about the router beacuse I had had successful
>> connections before the router device. When I turn off the synproxy or add
>> "keep state" instead of "synproxy state" I can successfully connecting.
>>
>> I want to take your opinions about why the handshake packages could not
>> be generate by pf synproxy?
>>
>> Regards,
>> Tugrul
>>
>>
>