ipnat.conf - map and rdr won't work!

[alexus]

On Tue, Jul 20, 2010 at 12:57 PM, Erik Norgaard <norgaard at locolomo.org> wrote:
> On 20/07/10 18.02, alexus wrote:
>>
>> On Mon, Jul 19, 2010 at 12:38 PM, Erik Norgaard<norgaard at locolomo.org>
>>  wrote:
>>>
>>> On 19/07/10 16.46, alexus wrote:
>>> Can't help you more, really, you need to investigate where packets are
>>> dropped, tcpdump is a great tool and the man-page is excelent, can't
>>> explain
>>> it better, if you don't like tcpdump then use any other packet sniffing
>>> tool
>>> at hand, snort for example.
>>
>> ipmon:
>>
>> 20/07/2010 10:22:00.123106 @2 NAT:RDR 172.16.172.16,22<- ->
>> 64.52.58.58,22 [69.10.67.106,6346 PR tcp]
>> 20/07/2010 10:26:00.340436 @2 NAT:EXPIRE 172.16.172.16,22<- ->
>> 64.52.58.58,22 [69.10.67.106,6346 PR tcp] Pkts 11/0 Bytes 640/0
>>
>> tcpdump:
>>
>> tcpdump: listening on fxp0, link-type EN10MB (Ethernet), capture size 96
>> bytes
>> 11:40:07.366519 IP (tos 0x0, ttl 49, id 48580, offset 0, flags [DF],
>> proto TCP (6), length 64) 69.10.67.106.9408>  64.52.58.58.22: S, cksum
>> 0xc05d (correct), 208454974:208454974(0) win 65535<mss
>> 1380,nop,wscale 3,nop,nop,timestamp 91387932 0,sackOK,eol>
>> 0 packets dropped by kernel
>
> What tcpdump options did you use, on what interface? where did you run it?
> on the hosting system or within the jail?

'tcpdump -n -i fxp0 -vv' was run on host
fxp0 is a public interface

>>> Do packets can get dropped because of your firewall default policy? For
>>> stealth it may be set to simply drop packets which result in a connection
>>> time-out rather than send a TCP-RST.
>
>> i disabled ipfw, and i dont have any rules inside of ipfilter
>
> You do have the default rule. IIRC this is set when you compile ipfilter, it
> can be set to either block or pass.

the main reason why i have ipfilter is because it requires by ipnat

> If you don't remember what it was, then you can override it by configuring
> two rules:
>
> pass in quick all
> pass out quick all

done

su-3.2# cat /etc/ipf.rules | grep -v ^#
pass in quick all
pass out quick all
su-3.2#

>>> Do you have any logs in the jail that indicate that the first packet is
>>> actually received? Do your firewall log connections? If not, see how you
>>> can
>>> enable logs on all rules to get more information.
>>
>> nothing gets to jail there for no logs inside of jail
>
> Ok, but you should be able to configure log on your firewall/nat rules. IIRC
> ipfilter does not permit log statement on nat rules, you can switch to
> packet filter it has almost same syntax and permits log.
>

plan b is to run natd, but i'd rather run ipnat especially that ipnat
used to work before no problem!

>>> Can you connect out from the jail, to external servers? only to the jail
>>> hosting server? Did the jail's ssh log tell anything?
>>
>> no i can not connect out from jail, as map doesn't work either
>> nothing gets to
>
> Nor to the hosting system?
>

i'm able to ssh out from jail to a host system as this local, no "map"
(nat) is needed for this connection

>>> You wrote you can connect with ssh from the hosting server to the jail,
>>> but
>>> it took a long time, did you investigate this? Is there some DNS issue
>>> that
>>> times out and causes the connection to fail?
>
> what about that "long time" I recall you mentioned?

my guess it's trying to do dns reverse look up and since map (nat)
doesn't work it takes long time
back in the days when nat was working, sshing it didn't take long time at all

>>> Can you ping your jail? Can you ping out? Default route is configured?
>>
>> i can ping my jail within host environment
>> once again nothing within jail works as map (nat) isn't working
>
> Are you sure you're actually ping'ing the jail? IIRC from your previous mail
> you have configured the jail IP both on the host environment and in the
> jail.

su-3.2# ping -c1 lama
PING lama (172.16.172.16): 56 data bytes
64 bytes from 172.16.172.16: icmp_seq=0 ttl=64 time=0.075 ms

--- lama ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.075/0.075/0.075/0.000 ms
su-3.2#

ip address tells me that this is in fact jail's IP

> So I suppose that from your host environment you can ssh into the jail? Did
> ssh start up, netstat -l? From the jail, can you ping the host environment?

su-3.2# jls
   JID  IP Address      Hostname                      Path
     1  172.16.172.16   lama                          /usr/jail/lama
su-3.2# jexec 1 /etc/rc.d/sshd status
sshd is running as pid 1085.
su-3.2# ps -p 1085
  PID  TT  STAT      TIME COMMAND
 1085  ??  IsJ    0:00.00 /usr/sbin/sshd
su-3.2#

>> default router isn't configured in rc.conf (inside of jail) as per
>> jail's man page its not needed
>> it was working fine before without it
>>
>>> There are tons of tests you can do to figure out what's failing.
>
> Do you have additional external ip addresses available?

unfortunately no, if i had them i wouldn't need to do "map" nor "rdr"

> Last time I played around with jail, I had this:
>
> ifconfig_vr1="inet 172.16.0.1/23"         # Hosting system
> ifconfig_vr1_alias0="inet 172.16.0.2/32"  # Jail
> ....
> jail_test_ip="172.16.0.2"
> ....
>
> So that would create an alias for for the jail and bypasss the need for rdr.
>
> BR, Erik
>

i know, i can run it that IP address as an alias on public interface,
but we on purpose added another NIC to be private NIC.

-- 
http://alexus.org/