[Bug 210408] Problem with outgoing traffic using ipfw and kernel nat originated from local address

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=210408

--- Comment #3 from smithi at nimnet.asn.au ---
(In reply to Mark Felder from comment #2)

Offhand I can think of three places that could be done:

1) /sbin/ipfw (userland)
a) when NAT is configured, eg ipfw nat 123 config [ip address | if iface] ...
b) when NAT would be first invoked, eg ipfw add [ruleno] nat 123 [condition/s]

2) /sys/netpfil/ipfw/ip_fw2.c (kernel)
when NAT is first actually invoked on a packet on the NAT interface.

3) /sys/netinet/libalias (kernel) (or from userland for natd(8))
on first use of an interface, ie (only) on the first packet processed.

(1a) seems unlikely, as 'ip address' may not map to an iface on rule creation, 
and a particular nat config may not even be used, or its rule not encountered.

(1b) perhaps, though its config needs consulting, and unless 'if iface' is 
specified it may not be straightforward to determine which interface - and 
we would only want TSO4 disabled on the NAT interface, not on any others.

(1) is userland, so it might be more appropriate to 'call' /sbin/ifconfig from 
there, though again the address to interface mapping - from routing table/s I 
assume - may not already be in place upon ruleset creation.

(2) and (3) are in-kernel. Perhaps the new libifconfig (ono) can be used from 
there, but I've only seen that go by in freebsd-net in passing.  This would 
 require testing for TSO4 being on, then setting it off (-tso or -tso4).

Separately, /sbin/ipfw should probably insist on (or change to) 'ipv4' rather 
 than 'ip' or 'all' on nat rules, to guard against passing libalias(3) any 
 ipv6 packets, another potential foot-shot.

Just a few thought-bubbles, FWIW ..

Ian

-- 
You are receiving this mail because:
You are on the CC list for the bug.