Hi,
Yes, I have (what appears to be) 100% functionality of the
forwarding/nat/etc.
That wouldn't work if forwarding wasn't enabled.
# cat /etc/sysctl.conf
net.inet.ip.forwarding=1
And I have rebooted multiple times.
Thanks,
Steve W.
On 26/06/2017 12:30 PM, Timo Myyrä wrote:
> Hmm, have you enabled net.inet.ip.forwarding?
>
> Timo
>
> Steve Williams <steve@williamsitconsulting.com> writes:
>
>> Hi,
>>
>> Packets from vether are going out NAT'd no problem. I have 100%
>> Internet access on 192.168.123.0/24.
>>
>> From my understanding, the "pass out quick inet all flags S/SA" allow
>> packets out and should create state for the connection for any ipv4
>> packets on any interface.
>>
>> Subsequent packets (these seem to have the "P"ush flag set) should
>> match the state and not get blocked.
>>
>> Hum... perhaps the states are expiring too fast?
>>
>> How do I find out if the state existed at the time that the packet was
>> blocked?
>>
>> Thanks,
>> Steve W.
>>
>>
>> On 26/06/2017 12:09 PM, Ville Valkonen wrote:
>>> Hello,
>>>
>>> a quick glance and it seems you aren't allowing vether traffic to pass.
>>>
>>> --
>>> Regards,
>>> Ville
>>>
>>> On Jun 26, 2017 8:19 PM, "Steve Williams"
>>> <steve@williamsitconsulting.com
>>> <mailto:steve@williamsitconsulting.com>> wrote:
>>>
>>> Hi,
>>>
>>> New install of OpenBSD 6.1 on apu2. Love the little box.
>>>
>>> I have em0 as the connection to the Internet and I bridged em1 and
>>> em2 together on 192.168.123.0.
>>>
>>> I've been using OpenBSD since the 2.7 days, but have never run NAT
>>> so this is my first foray into that world. I have followed the
>>> FAQ on "building a router" almost vebatim. It's working fine, but
>>> I am seeing some packets blocked with no effect on browsing behind
>>> the OpenBSD box.
>>>
>>> My ruleset:
>>>
>>> # pfctl -sr
>>> match in all scrub (no-df random-id)
>>> match out on egress inet from ! (egress:network) to any nat-to
>>> (egress:0) round-robin
>>> block drop log quick from <blocklist> to any
>>> block drop log quick from <bad_hosts> to any
>>> block drop log all
>>> pass out quick inet all flags S/SA
>>> pass in on vether0 inet all flags S/SA
>>> pass in on em1 inet all flags S/SA
>>> pass in on em2 inet all flags S/SA
>>> pass in on egress inet proto tcp from any to (egress) port = 22
>>> flags S/SA
>>> pass in on egress inet proto tcp from any to (egress) port = 993
>>> flags S/SA
>>> pass in on egress inet proto tcp from any to (egress) port = 80
>>> flags S/SA
>>> pass in on egress inet proto tcp from any to (egress) port = 443
>>> flags S/SA
>>>
>>> # tcpdump -n -e -ttt -i pflog0 # from man pflog man page
>>> Jun 26 09:45:54.241145 rule 4/(match) block in on vether0:
>>> 192.168.123.2.38022 > 216.58.216.165.443: P 0:1375(1375) ack 1 win
>>> 1805 (DF)
>>> Jun 26 09:45:54.701283 rule 4/(match) block in on vether0:
>>> 192.168.123.2.38022 > 216.58.216.165.443: P 0:1375(1375) ack 1 win
>>> 1805 (DF)
>>> Jun 26 09:45:55.623757 rule 4/(match) block in on vether0:
>>> 192.168.123.2.38022 > 216.58.216.165.443: P 0:1375(1375) ack 1 win
>>> 1805 (DF)
>>> Jun 26 09:45:57.460985 rule 4/(match) block in on vether0:
>>> 192.168.123.2.38022 > 216.58.216.165.443: P 0:1375(1375) ack 1 win
>>> 1805 (DF)
>>> Jun 26 09:46:01.150933 rule 4/(match) block in on vether0:
>>> 192.168.123.2.38022 > 216.58.216.165.443: P 0:1375(1375) ack 1 win
>>> 1805 (DF)
>>> Jun 26 09:46:08.522599 <tel:08.522599> rule 4/(match) block in on
>>> vether0: 192.168.123.2.38022 > 216.58.216.165.443: P 0:1375(1375)
>>> ack 1 win 1805 (DF)
>>> Jun 26 09:46:47.479083 rule 4/(match) block in on vether0:
>>> 192.168.123.2.46549 > 172.217.3.206.443: P
>>> 4042174712:4042174735(23) ack 2564095917 win 1593 (DF)
>>> Jun 26 09:46:47.896295 rule 4/(match) block in on vether0:
>>> 192.168.123.2.53452 > 23.23.126.54.443: P
>>> 4003838125:4003838156(31) ack 2044539346 win 65535 (DF)
>>> Jun 26 09:46:47.896662 rule 4/(match) block in on vether0:
>>> 192.168.123.2.53452 > 23.23.126.54.443: R 31:31(0) ack 1 win 65535
>>> (DF)
>>> Jun 26 09:46:47.896674 rule 4/(match) block in on vether0:
>>> 192.168.123.2.59762 > 216.58.216.163.443: P
>>> 113176577:113176608(31) ack 2619790719 win 1403 (DF)
>>> Jun 26 09:46:47.896685 rule 4/(match) block in on vether0:
>>> 192.168.123.2.59762 > 216.58.216.163.443: F 31:31(0) ack 1 win
>>> 1403 (DF)
>>> Jun 26 09:46:47.896711 rule 4/(match) block in on vether0:
>>> 192.168.123.2.39279 > 31.13.77.6.443: P 4254697166:4254697197(31)
>>> ack 2615144509 win 1545 (DF)
>>> Jun 26 09:46:47.896735 rule 4/(match) block in on vether0:
>>> 192.168.123.2.39279 > 31.13.77.6.443: R 31:31(0) ack 1 win 1545 (DF)
>>>
>>> # pfctl -R 4 -sr
>>> block drop log all
>>>
>>> It is not all https traffice that is being blocked as I can hit my
>>> banking site, etc. Does anyone have an idea why are these packets
>>> being blocked?
>>>
>>> Thanks,
>>> Steve Williams
>>>
>>>
>>>
No comments:
Post a Comment