SynProxy had a trouble when located front of a router device

[Oguz Yilmaz]

Hello,

Does pf synproxy support synproxying when internal side is 8021q VLAN?

Best Regards,

--
Oguz YILMAZ


On Fri, Oct 24, 2014 at 1:52 PM, Tugrul Erdogan
<h.tugrul.erdogan at gmail.com> wrote:
> I have important founding. I think it is about VLAN between FreeBSD-Router
> in diagram.
>
> While Attacker-FreeBSD connection is normal IP connection, FreeBSD-Router
> connection was tagged VLAN 159.
> While FreeBSD-Router connection is VLAN based, synproxy rule State
> Creations value increase, synproxy sends ACKS to the Attacker.
> However synproxy replay with original server does not working ( The routing
> rule counter on os routing table which redirect packets to FreeBSD-Router
> side is increasing but the packet can not be created  ).
> When I change FreeBSD-Router connection to normal IP connection without
> VLAN, it starts to working.
>
> What can be the problem and solution?
>
>
>
>
> On Thu, Oct 23, 2014 at 9:36 PM, Tugrul Erdogan <h.tugrul.erdogan at gmail.com>
> wrote:
>
>> Update:
>>
>> The topololgy has been redrawed below:
>>
>>
>> | Atacker | <-> | FreeBSD | <-> | Router | <-> | Victim |
>>
>>
>> Thanks,
>>
>>
>> PS: Although connections lost by pf synproxy, the pings (form attacker to
>> victim) can succesfully returns.
>>
>>
>>
>>
>> On Thu, Oct 23, 2014 at 9:25 PM, Tugrul Erdogan <
>> h.tugrul.erdogan at gmail.com> wrote:
>>
>>> Hi,
>>>
>>> I have a trouble at pf synproxy state handshakıng mechanism. I have been
>>> using pf for years, but first time I have  a router at the backpane of
>>> topology. The schema of my topology given below:
>>>
>>> ---------------------                        ---------------------------
>>>                    -------------------         ----------------------
>>>
>>> Attacker                <---------->       FreeBSD(Test)
>>>  <----------->    Router          <---->    Victim
>>>
>>> -------------------                          ---------------------------
>>>                      -----------------             -------------------
>>>
>>> I am trying to connect from attacker to the victim from port 80. Without
>>> synproxy rule I have successfully conneting. Whenever I activate synproxy
>>> state, the client(attacker) side handshaking completing (the outer
>>> interface of FreeBSD device)
>>>
>>> 21:09:53.531421 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [S], seq
>>> 1458776780, win 5840, options [mss 1460,sackOK,TS val 1336836512 ecr
>>> 0,nop,wscale 7], length 0
>>> 21:09:53.531494 IP AA.BB.189.100.80 > AA.BB.183.93.51510: Flags [S.], seq
>>> 2093170245, ack 1458776781, win 0, options [mss 1460], length 0
>>> 21:09:53.531524 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ack
>>> 1, win 5840, length 0
>>> 21:09:56.533680 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ack
>>> 1, win 5840, length 0
>>> 21:10:02.532255 IP AA.BB.183.93.51510 > AA.BB.189.100.80: Flags [.], ack
>>> 1, win 5840, length 0
>>>
>>> after that the  "pfct -vvss" showing:
>>>
>>> ix1 tcp AA.BB..183.93:51513 -> AA.BB..189.100:80       PROXY:DST
>>>
>>> and there is no package at inner interface of FreeBSD device at the
>>> result of tcpdump. After some seconds FreeBSD generates RST package both
>>> side. (There is no handshake SYN or ACK packages generated by pf synproxy
>>> at the inner interface)
>>>
>>> I think that the problem is about the router beacuse I had had successful
>>> connections before the router device. When I turn off the synproxy or add
>>> "keep state" instead of "synproxy state" I can successfully connecting.
>>>
>>> I want to take your opinions about why the handshake packages could not
>>> be generate by pf synproxy?
>>>
>>> Regards,
>>> Tugrul
>>>
>>>
>>
> _______________________________________________
> freebsd-pf at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-pf
> To unsubscribe, send any mail to "freebsd-pf-unsubscribe at freebsd.org"