Hello,
I have a FreeBSD 13 system with a single physical interface that I'm using aliases (virtual interfaces?) for additional IP addresses that are in separate subnets. When attempting to send traffic from one alias to another, my traffic dies at SYN_SENT:CLOSED after 4 packets (when viewing from pftop). From Googling, I think this is a asymmetric routing problem as when I disable pf, the traffic flow works and I've verified it's not actually being blocked by any pf rules, so it must be a routing issue right?
I found this guide from pfSense that makes some suggestions about using the state type "sloppy" and I think I'm able to reproduce in pf.conf what they're doing in the GUI (see the bottom of my pf.conf) but the traffic is still failing to traverse between the aliases when pf is enabled. The specific scenario is I'm hosting an IRCD on $ircd_ip and my IRC clients connect from $irc_ip. I could get around this issue by using the same interface for both the IRCD and IRC clients but I like to have them on separate interfaces. Below are copies of all my configuration files:
pftop
ifconfig
pf.conf
rc.conf
I have a FreeBSD 13 system with a single physical interface that I'm using aliases (virtual interfaces?) for additional IP addresses that are in separate subnets. When attempting to send traffic from one alias to another, my traffic dies at SYN_SENT:CLOSED after 4 packets (when viewing from pftop). From Googling, I think this is a asymmetric routing problem as when I disable pf, the traffic flow works and I've verified it's not actually being blocked by any pf rules, so it must be a routing issue right?
I found this guide from pfSense that makes some suggestions about using the state type "sloppy" and I think I'm able to reproduce in pf.conf what they're doing in the GUI (see the bottom of my pf.conf) but the traffic is still failing to traverse between the aliases when pf is enabled. The specific scenario is I'm hosting an IRCD on $ircd_ip and my IRC clients connect from $irc_ip. I could get around this issue by using the same interface for both the IRCD and IRC clients but I like to have them on separate interfaces. Below are copies of all my configuration files:
pftop
Code:
PR DIR SRC DEST STATE AGE EXP PKTS BYTES
tcp Out 44.55.194.119:41863 44.55.215.69:6667 SYN_SENT:CLOSED 00:00:26 00:00:11 4 240ifconfig
Code:
[root@freebsd ~]# ifconfig
vtnet0: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=4c079b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,TSO6,LRO,VLAN_HWTSO,LINKSTATE,TXCSUM_IPV6>
ether fa:16:3e:56:5a:7d
inet6 fe80::f816:3eff:fe58:5a7c%vtnet0 prefixlen 64 scopeid 0x1
inet 44.55.245.22 netmask 0xffffff00 broadcast 192.99.245.255
inet 44.55.215.69 netmask 0xffffffff broadcast 144.217.215.69
inet 44.55.200.204 netmask 0xffffffff broadcast 142.4.200.204
inet 44.55.194.119 netmask 0xffffffff broadcast 167.114.194.119
inet 44.55.177.153 netmask 0xffffffff broadcast 142.44.177.153
inet 44.55.215.68 netmask 0xffffffff broadcast 144.217.215.68
media: Ethernet autoselect (10Gbase-T <full-duplex>)
status: active
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
inet 44.55.245.22 netmask 0xffffff00
inet 127.0.0.1 netmask 0xff000000
groups: lo
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33160
groups: pflogpf.conf
Bash:
## IRCd Inbound IP Address ##
ircd_ip="44.55.215.69"
## IRC Outbound IP Address ##
irc_ip="44.55.194.119"
## Set and drop these IP ranges on public interface ##
rfc1918 = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
0.0.0.0/8, 240.0.0.0/4 }"
irc_ports = "{6667, 6697, 7000}"
## enable these services ##
int_services = "{domain, ntp, www, https, ssh}"
## Skip loop back interface - Skip all PF processing on interface ##
set skip on lo
## Sets the interface for which PF should gather statistics such as bytes in/out and packets passed/blocked ##
set loginterface $ext_if
# Deal with attacks based on incorrect handling of packet fragments
scrub in all
## Blocking spoofed packets
antispoof quick for $ext_if
## Set default policy ##
block return in log all
block out log all
## Drop all Non-Routable Addresses ##
block drop in quick on $ext_if from $rfc1918 to any
block drop out quick on $ext_if from any to $rfc1918
## Allow Ping-Pong stuff. Be a good sysadmin ##
pass inet proto icmp icmp-type echoreq
## Allow essential outgoing traffic ##
pass out quick on $ext_if proto { tcp, udp } to any port $int_services
## Allow IRC Outbound traffic of specific IP ##
pass out quick on $ext_if proto tcp from $irc_ip to any port $irc_ports keep state
## IRCd Allow Rule ##
pass in quick on $ext_if inet proto tcp from any to $ircd_ip port $irc_ports flags any keep state
## Test rules to fix local IRC connections ##
pass quick on $ext_if proto tcp from $ircd_ip to $irc_ip flags any keep state(sloppy)
pass quick on $ext_if from $ircd_ip to $irc_ip keep state(sloppy)
## Test rules to fix local IRC connections ##
pass quick on $ext_if proto tcp from $irc_ip to $ircd_ip flags any keep state(sloppy)
pass quick on $ext_if from $irc_ip to $ircd_ip keep state(sloppy)rc.conf
Code:
hostname="freebsd"
ifconfig_DEFAULT="inet 44.55.245.22 netmask 255.255.255.0"
ifconfig_vtnet0_alias0="inet 44.55.215.69 netmask 255.255.255.255"
ifconfig_vtnet0_alias1="inet 44.55.200.204 netmask 255.255.255.255"
ifconfig_vtnet0_alias2="inet 44.55.194.119 netmask 255.255.255.255"
ifconfig_vtnet0_alias3="inet 44.55.177.153 netmask 255.255.255.255"
ifconfig_vtnet0_alias4="inet 44.55.215.68 netmask 255.255.255.255"
growfs_enable="YES"
sshd_enable="YES"
pf_enable="YES"
pf_rules="/usr/local/etc/pf.conf"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
defaultrouter="44.55.245.1"