>Number: 147720
>Category: misc
>Synopsis: ipfw dynamic rules and fwd
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Jun 09 12:30:04 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator: Dmitriy Demidov
>Release: FreeBSD 7-STABLE
>Organization:
>Environment:
FreeBSD evo.local.home 7.3-PRERELEASE FreeBSD 7.3-PRERELEASE #0: Sat Feb 20
22:57:09 EET 2010 r...@evo.local.home:/usr/obj/usr/src/sys/STABLE i386
>Description:
There is one bug with ipfw keep-state rules and fwd action.
You are unable to make source based routing of incoming connections using this
ruleset:
=======
# $ext_if1 - ISP1
# $gw1 - ISP1 GW
# $ext_if2 - ISP2
# $gw2 - ISP2 GW
# $int_if - internal net
ipfw add 100 skipto 300 tag 1 in recv $ext_if1 keep-state
ipfw add 200 skipto 300 tag 2 in recv $ext_if2 keep-state
ipfw add 300 allow { recv $ext_if1 or recv $ext_if2 }
ipfw add 400 allow in recv $int_if
ipfw add 500 fwd $gw1 tagged 1
ipfw add 600 fwd $gw2 tagged 2
=======
To make it working you should patch /sys/netinet/ipfw/ip_fw2.c with this:
====
(find this line)
if (!q || dyn_dir == MATCH_FORWARD)
(change it to this)
if (sa->sin_port && (!q || dyn_dir == MATCH_FORWARD))
====
This problem is presend in FreeBSD 9-CURRENT as well.
Can somebody please merge this patch to CURRENT?
Credits for this patch goes to Vadim Goncharov
nuclight.livejournal.com/124348.html
>How-To-Repeat:
have FreeBSD host with two NIC's connected to different networks with different
GW each. Applay ipfw rules from example provided. Start some service
(SSH/Apache/etc). Make a try to connect to connect to service from network
behing GW that is not configured as default gateway on FreeBSD host - answer
will go via second NIC/default GW. keep-state ruleset do not works.
>Fix:
applay patch
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
