rdr (pf) doesn't work anymore on 10.2-Release

Makoto Tanaka

Makoto Tanaka

I have upgraded one of gateway server from FreeBSD10.1-RELEASE to FreeBSD10.2-RELEASE. I found critical issue on Port Forwarding rule on pf.

Here is scenario that you can reproduce the issue. I am on HOST01. I am trying to access the Server01 via GW01:10022.
HOST01 -> GW01: 10022 -> Server01:22

This is my pf.conf on GW01. This configuration was working on FreeBSD10.1-RELEASE-p17.
GW01 /etc/pf.conf:
Code: 
rdr pass log on $ext_if proto tcp from any to ($ext_if) port 10022 -> {<HOST01>} port 22

block in log
pass out

pass in log on $ext_if proto tcp from any to ($ext_if) port 10022

Code: 
[HOST01]$ ssh -p 10022 GW01
ssh: connect to host GW01 port 10022: Operation timed out

I found something is wrong with the packet between HOST01 and Server01.
Here is tcpdump output on server01.
Code: 
[root@Server01]# tcpdump -v -i re0 host HOST01 and port 22

17:33:32.626650 IP (tos 0x0, ttl 64, id 28043, offset 0, flags [DF], proto TCP (6), length 60, bad cksum 0 (->37b7)!)
  Server01.ssh > HOST01.35723: Flags [S.], cksum 0x63b6 (correct), seq 1898239111, ack 1793874393, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 2315420046 ecr 98805561], length 0
17:33:32.626984 IP (tos 0x0, ttl 64, id 29836, offset 0, flags [DF], proto TCP (6), length 52)
  HOST01.35723 > Server01.ssh: Flags [.], cksum 0x8e70 (correct), ack 1, win 1040, options [nop,nop,TS val 98805562 ecr 2315420046], length 0
17:33:32.632417 IP (tos 0x0, ttl 64, id 28048, offset 0, flags [DF], proto TCP (6), length 101, bad cksum 0 (->3789)!)
  Server01.ssh > HOST01.35723: Flags [P.], cksum 0x1bba (correct), seq 1:50, ack 1, win 1040, options [nop,nop,TS val 2315420052 ecr 98805562], length 49
17:33:32.632673 IP (tos 0x0, ttl 64, id 29849, offset 0, flags [DF], proto TCP (6), length 74)
  HOST01.35723 > Server01.ssh: Flags [P.], cksum 0x07b9 (correct), seq 1:23, ack 50, win 1040, options [nop,nop,TS val 98805567 ecr 2315420052], length 22
17:33:32.632678 IP (tos 0x0, ttl 64, id 29850, offset 0, flags [DF], proto TCP (6), length 52)
  HOST01.35723 > Server01.ssh: Flags [F.], cksum 0x8e1d (correct), seq 23, ack 50, win 1040, options [nop,nop,TS val 98805567 ecr 2315420052], length 0
17:33:32.632683 IP (tos 0x0, ttl 64, id 28049, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 0 (->37b9)!)
  Server01.ssh > HOST01.35723: Flags [.], cksum 0x8e1d (correct), ack 24, win 1040, options [nop,nop,TS val 2315420052 ecr 98805567], length 0

If the destination is GW01:22 via GW01:10022 doesn't have any issue.

GW01 /etc/pf.conf:
Code: 
rdr pass log on $ext_if proto tcp from any to ($ext_if) port 10022 -> {<GW01>} port 22

block in log
pass out

pass in log on $ext_if proto tcp from any to ($ext_if) port 10022
Is anyone having same experience with 10.2-Release?
 
Try

Code: 
gw_ip = ""
ext_if = ""
rdr pass on $ext_if proto tcp from any to $ext_if port 10022 -> $gw_ip port 22
block in log on $ext_if all
 
You must log in or register to reply here.
Back
Top