Help setting up a PF NAT gateway

[Stefan Midjich]

Simplest of things but I'm failing miserably.

$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255

$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two
machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255

For troubleshooting I have removed the block all rule, to confirm that
it is in fact my NAT related rules that don't work.

These are my first and only NAT rules. The other rules work fine and
are just to allow SSH to my management interface and ICMP response
from the external IP and from the internal gateway IP. Besides I've
removed the block all so the other rules don't matter much now.

match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
pass inet from 10.221.181.0/24 to any flags S/SA keep state

With tcpdump I can see packets going to vic3, but no further.

With block all commented out I can fully test the network around and
everything is working just fine, I can nc -kl 50.50.50.59 65535 and
connect to that port from anywhere on the internet. I just can't
connect out from the private network through the gateway. The systems
in the private network have 10.221.181.10 as their default gateway.

I even have the Book of PF 2nd edition here but it's of no use, the
rules are mostly from there. Just for troubleshooting I can also nc
-kl 10.221.181.10 65535 on the gateway and connect to that port from
the private network machines without issues.

So please tell me, what am I missing in this nat-to rule?

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich

[Christiano F. Haesbaert]

Post by Stefan Midjich
Simplest of things but I'm failing miserably.
$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255
$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two
machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255
For troubleshooting I have removed the block all rule, to confirm that
it is in fact my NAT related rules that don't work.
These are my first and only NAT rules. The other rules work fine and
are just to allow SSH to my management interface and ICMP response
from the external IP and from the internal gateway IP. Besides I've
removed the block all so the other rules don't matter much now.
match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
pass inet from 10.221.181.0/24 to any flags S/SA keep state
With tcpdump I can see packets going to vic3, but no further.
With block all commented out I can fully test the network around and
everything is working just fine, I can nc -kl 50.50.50.59 65535 and
connect to that port from anywhere on the internet. I just can't
connect out from the private network through the gateway. The systems
in the private network have 10.221.181.10 as their default gateway.
I even have the Book of PF 2nd edition here but it's of no use, the
rules are mostly from there. Just for troubleshooting I can also nc
-kl 10.221.181.10 65535 on the gateway and connect to that port from
the private network machines without issues.
So please tell me, what am I missing in this nat-to rule?

Hi, can you paste your pf.conf ?
The output of ifconfig would be good too.

[Stefan Midjich]

ManagementIF = "vic0"
PFsyncIF = "vic1"
LocalIF = "lo0"
ManagementPorts = "{ 1022, 22 }"
UDPManagementPorts = "{ domain }"
ICMPTypes = "{ echorep, echoreq, unreach }"
set skip on { lo0 vic1 }
OutIF = "vic2"
InIF = "vic3"
pass quick on vic0 inet proto tcp from any to any port = 1022 flags
S/SA keep state label "PassMGMTSSH"
pass quick on vic0 inet proto tcp from any to any port = ssh flags
S/SA keep state label "PassMGMTSSH"
pass on vic0 proto udp from any to any port = domain keep state label
"PassMGMTDNS"
pass on vic0 inet proto icmp all icmp-type echorep keep state label
"PassMGMTICMP"
pass on vic0 inet proto icmp all icmp-type echoreq keep state label
"PassMGMTICMP"
pass on vic0 inet proto icmp all icmp-type unreach keep state label
"PassMGMTICMP"
pass quick on vic2 proto carp all keep state label "PassCarp"
pass quick on vic3 proto carp all keep state label "PassCarp"
pass quick inet proto icmp from any to 50.50.50.0/24 icmp-type echoreq
keep state label "PingOut"
pass quick inet proto icmp from any to 50.50.50.0/24 icmp-type echorep
keep state label "PingOut"
pass quick inet proto icmp from any to 50.50.50.0/24 icmp-type unreach
keep state label "PingOut"
pass quick inet proto icmp from 10.221.181.0/24 to 10.221.181.10
icmp-type echoreq keep state label "PingIn"
pass quick inet proto icmp from 10.221.181.0/24 to 10.221.181.10
icmp-type echorep keep state label "PingIn"
pass quick inet proto icmp from 10.221.181.0/24 to 10.221.181.10
icmp-type unreach keep state label "PingIn"
match in on vic3 inet from 10.221.181.0/24 to any label "NATOut"
nat-to (vic2) round-robin
pass inet from 10.221.181.0/24 to any flags S/SA keep state

vic2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:50XXXXX
priority: 0
groups: egress
media: Ethernet autoselect
status: active
inet 50.50.50.59 netmask 0xffffff00 broadcast 50.50.50.255
inet6 fe80::250:56ff:fe8e:63%vic2 prefixlen 64 scopeid 0x3
vic3: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:50:XXXXX
priority: 0
media: Ethernet autoselect
status: active
inet 10.221.181.10 netmask 0xffffff00 broadcast 10.221.181.255
inet6 fe80::250:56ff:fe8e:64%vic3 prefixlen 64 scopeid 0x4

Routing tables

Internet:
Destination Gateway Flags Refs Use Mtu Prio Iface
default 50.50.50.1 UGS 0 80 - 8 vic2
10/8 10.220.100.1 UGS 2 2869 - 8 vic0
10.90.100/24 link#2 UC 1 0 - 4 vic1
10.90.100.10 XXXXX:00:62 UHLc 0 2 - 4 lo0
10.220.100/24 link#1 UC 3 0 - 4 vic0
10.220.100.1 XXXXX07:ac:00 UHLc 1 0 - 4 vic0
10.220.100.10 XXXXX:49:16 UHLc 0 489 - 4 vic0
10.220.100.209 XXXXX:26:05 UHLc 1 5010 - 4 vic0
10.221.181/24 link#4 UC 0 0 - 4 vic3
127/8 127.0.0.1 UGRS 0 0 33160 8 lo0
127.0.0.1 127.0.0.1 UH 1 0 33160 4 lo0
50.50.50/24 link#3 UC 3 0 - 4 vic2
50.50.50.1 XXXXXf:d4:20 UHLc 1 0 - 4 vic2
50.50.50.6 XXXXX81:86:b6 UHLc 0 0 - 4 vic2
50.50.50.7 XXXXXX:50:87:14 UHLc 0 0 - 4 vic2
224/4 127.0.0.1 URS 0 0 33160 8 lo0

Please note that I have removed public ip-address and other private details.

Post by Christiano F. Haesbaert

Post by Stefan Midjich
Simplest of things but I'm failing miserably.
$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255
$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two
machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255
For troubleshooting I have removed the block all rule, to confirm that
it is in fact my NAT related rules that don't work.
These are my first and only NAT rules. The other rules work fine and
are just to allow SSH to my management interface and ICMP response
from the external IP and from the internal gateway IP. Besides I've
removed the block all so the other rules don't matter much now.
match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
pass inet from 10.221.181.0/24 to any flags S/SA keep state
With tcpdump I can see packets going to vic3, but no further.
With block all commented out I can fully test the network around and
everything is working just fine, I can nc -kl 50.50.50.59 65535 and
connect to that port from anywhere on the internet. I just can't
connect out from the private network through the gateway. The systems
in the private network have 10.221.181.10 as their default gateway.
I even have the Book of PF 2nd edition here but it's of no use, the
rules are mostly from there. Just for troubleshooting I can also nc
-kl 10.221.181.10 65535 on the gateway and connect to that port from
the private network machines without issues.
So please tell me, what am I missing in this nat-to rule?

Hi, can you paste your pf.conf ?
The output of ifconfig would be good too.

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich

[Peter N. M. Hansteen]

A couple of general comments,

"keep state" is the default, no need to specify

"from any to any port = " - "to port" does the same thing

quick means "if we match this, we do no more evaluation for this one".
I suspect your quick rules before the nat-to match rules mean that
anything that matches the quicks pass without hitting the match with the
nat-to. fine if it's your intention, if not, check what really happens
(tcpdump is your friend).

But again, please check that you have a basic network config and
connectivity to eliminate.

[pavel pocheptsov]

match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
in what reason you paste "round-robin"?
also you need
pass in on $local_if from $localnet to any
pass out on $ext_if from $localnet to any


10 P>P:QQP1QQ 2011, 19:42 P>Q Stefan Midjich <***@gmail.com>:




Simplest of things but I'm failing miserably.

$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255

$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two
machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255

For troubleshooting I have removed the block all rule, to confirm that
it is in fact my NAT related rules that don't work.

These are my first and only NAT rules. The other rules work fine and
are just to allow SSH to my management interface and ICMP response
from the external IP and from the internal gateway IP. Besides I've
removed the block all so the other rules don't matter much now.

match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
pass inet from 10.221.181.0/24 to any flags S/SA keep state

With tcpdump I can see packets going to vic3, but no further.

With block all commented out I can fully test the network around and
everything is working just fine, I can nc -kl 50.50.50.59 65535 and
connect to that port from anywhere on the internet. I just can't
connect out from the private network through the gateway. The systems
in the private network have 10.221.181.10 as their default gateway.

I even have the Book of PF 2nd edition here but it's of no use, the
rules are mostly from there. Just for troubleshooting I can also nc
-kl 10.221.181.10 65535 on the gateway and connect to that port from
the private network machines without issues.

So please tell me, what am I missing in this nat-to rule?

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich

[Stefan Midjich]

That was from the output of pfctl -vf /etc/pf.conf so it expands the
rules and adds all that is implied, like keep state for example.

Post by Stefan Midjich
match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
in what reason you paste "round-robin"?
also you need
pass in on $local_if from $localnet to any
pass out on $ext_if from $localnet to any
Simplest of things but I'm failing miserably.
$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255
$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two
machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255
For troubleshooting I have removed the block all rule, to confirm that
it is in fact my NAT related rules that don't work.
These are my first and only NAT rules. The other rules work fine and
are just to allow SSH to my management interface and ICMP response
from the external IP and from the internal gateway IP. Besides I've
removed the block all so the other rules don't matter much now.
match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
pass inet from 10.221.181.0/24 to any flags S/SA keep state
With tcpdump I can see packets going to vic3, but no further.
With block all commented out I can fully test the network around and
everything is working just fine, I can nc -kl 50.50.50.59 65535 and
connect to that port from anywhere on the internet. I just can't
connect out from the private network through the gateway. The systems
in the private network have 10.221.181.10 as their default gateway.
I even have the Book of PF 2nd edition here but it's of no use, the
rules are mostly from there. Just for troubleshooting I can also nc
-kl 10.221.181.10 65535 on the gateway and connect to that port from
the private network machines without issues.
So please tell me, what am I missing in this nat-to rule?
--
Med vdnliga hdlsningar / With kind regards
Stefan Midjich

--


Med vC$nliga hC$lsningar / With kind regards

Stefan Midjich

[Christiano F. Haesbaert]

Post by Stefan Midjich
That was from the output of pfctl -vf /etc/pf.conf so it expands the
rules and adds all that is implied, like keep state for example.

I think that is not what you want:
match in on vic3 inet from 10.221.181.0/24 to any label "NATOut"
nat-to (vic2) round-robin

You want to match packets going out your external interface, and then
nat-to the external interface address, so try something like:

match out on vic2 inet from 10.221/181.0/24 nat-to (vic2)

Considering vic2 as your external interface.

[Stefan Midjich]

match out on egress inet from vic3:network nat-to (egress:0)

This is the new rule then, as it appears in pfctl -v

match out on egress inet from 10.221.181.0/24 to any nat-to (egress:0)
round-robin

vic2 is only NIC in egress group in ifconfig.

nc -vv cvs.openbsd.org 25 from 10.221.181.20 does not connect even
though there is no block rule now.

Post by Stefan Midjich

Post by Stefan Midjich
That was from the output of pfctl -vf /etc/pf.conf so it expands the
rules and adds all that is implied, like keep state for example.

match in on vic3 inet from 10.221.181.0/24 to any label "NATOut"
nat-to (vic2) round-robin
You want to match packets going out your external interface, and then
match out on vic2 inet from 10.221/181.0/24 nat-to (vic2)
Considering vic2 as your external interface.

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich

[Mark (obsd)]

Hi Stefan,

Post by Stefan Midjich
Simplest of things but I'm failing miserably.
...
With tcpdump I can see packets going to vic3, but no further.

Do you definitely have forwarding enabled?

# sysctl net.inet.ip.forwarding
net.inet.ip.forwarding=1

It that were 0 instead of 1, you'd get your symptoms. Edit /etc/sysctl.conf
to enable forwarding if you haven't.

Regards,
Mark

[Stefan Midjich]

Yes forwarding is enabled. I have followed the Book of PF 2nd Edition so far.

Post by Mark (obsd)
Hi Stefan,

Post by Stefan Midjich
Simplest of things but I'm failing miserably.
...
With tcpdump I can see packets going to vic3, but no further.

Do you definitely have forwarding enabled?
# sysctl net.inet.ip.forwarding
net.inet.ip.forwarding=1
It that were 0 instead of 1, you'd get your symptoms. Edit

/etc/sysctl.conf

Post by Mark (obsd)
to enable forwarding if you haven't.
Regards,
Mark

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich

[Stefan N]

Hi Stefan,

As you mentioned that the IP forwarding is already enabled on your
system.
Have you configured the IP alias on the network interface for the NAT
purpose?
If the NAT is done on external interface then you'll need to add in
the IP alias on /etc/hostname.vic2

Please read the guide from openbsd url
below:http://www.openbsd.org/cgi-bin/man.cgi?query=hostname.if&apropos=0&sekt
ion=0&manpath=OpenBSD+4.9&arch=i386&format=html

Sample of hostname.if config
with IP alias:

A typical file contains only one line, but more extensive
files are possible, for example: inet 10.0.1.12 255.255.255.0 10.0.1.255 media
100baseTX description Uplink inet alias 10.0.1.13 255.255.255.255 10.0.1.13
inet alias 10.0.1.14 255.255.255.255 NONE inet alias 10.0.1.15 255.255.255.255
inet alias 10.0.1.16 0xffffffff # This is an example comment line. inet6 alias
fec0::1 64 inet6 alias fec0::2 64 anycast !route add 65.65.65.65 10.0.1.13 up
I hope it helps.

Regards,
Stefan



________________________________
From:
Stefan Midjich <***@gmail.com>
To: Mark (obsd) <openbsd-***@nerdish.us>
Cc: ***@openbsd.org
Sent: Tuesday, October 11, 2011 2:06 AM
Subject: Re: Help
setting up a PF NAT gateway

Yes forwarding is enabled. I have followed the
Book of PF 2nd Edition so far.

2011/10/10 Mark (obsd)

Post by Mark (obsd)
Hi Stefan,
On Mon, Oct 10, 2011 at 10:38 AM,

Post by Stefan Midjich
Simplest of things but I'm

failing miserably.

Post by Mark (obsd)

Post by Stefan Midjich
...
With tcpdump I can see packets going to

vic3, but no further.

Post by Mark (obsd)
Do you definitely have forwarding enabled?
#

sysctl net.inet.ip.forwarding

Post by Mark (obsd)
net.inet.ip.forwarding=1
It that were 0

instead of 1, you'd get your symptoms. Edit
/etc/sysctl.conf

Post by Mark (obsd)
to enable

forwarding if you haven't.

Post by Mark (obsd)
Regards,
Mark

--


Med vdnliga hdlsningar /
With kind regards

Stefan Midjich

[Stefan Midjich]

No I was not aware of this. Could you please explain the meaning of an
alias address on the external interface for NAT?

There is no mention of using an alias for NAT in this document for
example http://www.openbsd.org/faq/pf/nat.html

Just to be clear, I already have an external and internal physical
interface to work with, so I am unclear as to why I need an alias.

Post by Mark (obsd)
Hi Stefan,
As you mentioned that the IP forwarding is already enabled on your system.
Have you configured the IP alias on the network interface for the NAT
purpose?
If the NAT is done on external interface then you'll need to add in the IP
alias on /etc/hostname.vic2

http://www.openbsd.org/cgi-bin/man.cgi?query=hostname.if&apropos=0&sektion=0&
manpath=OpenBSD+4.9&arch=i386&format=html

Post by Mark (obsd)
A typical file contains only one line, but more extensive files are
inet 10.0.1.12 255.255.255.0 10.0.1.255 media 100baseTX description
Uplink
inet alias 10.0.1.13 255.255.255.255 10.0.1.13
inet alias 10.0.1.14 255.255.255.255 NONE
inet alias 10.0.1.15 255.255.255.255
inet alias 10.0.1.16 0xffffffff
# This is an example comment line.
inet6 alias fec0::1 64
inet6 alias fec0::2 64 anycast
!route add 65.65.65.65 10.0.1.13
up
I hope it helps.
Regards,
Stefan
________________________________
Sent: Tuesday, October 11, 2011 2:06 AM
Subject: Re: Help setting up a PF NAT gateway
Yes forwarding is enabled. I have followed the Book of PF 2nd Edition so far.

Post by Mark (obsd)
Hi Stefan,

Post by Stefan Midjich
Simplest of things but I'm failing miserably.
...
With tcpdump I can see packets going to vic3, but no further.

Do you definitely have forwarding enabled?
# sysctl net.inet.ip.forwarding
net.inet.ip.forwarding=1
It that were 0 instead of 1, you'd get your symptoms. Edit

/etc/sysctl.conf

Post by Mark (obsd)
to enable forwarding if you haven't.
Regards,
Mark

--
Med vdnliga hdlsningar / With kind regards
Stefan Midjich

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich

[Stefan N]

Okay. If you're going to give access to internet users to be able to access
your system inside your LAN/DMZ(eg webserver), you will need to do NAT.
If you
want the server which is configured by private ip address is reachable from
internet users, you will need NAT.

The way you do NAT might depend on your
network infra setup and how you design and plan the traffic flow.
IP aliasing
is associating more than one IP address to a network interface. With this, one
node on a network can have multiple connections to a network, each serving a
different purpose.Now I will explain you with an example so that you can
visualize it in a better way:

I have web server with IP address 192.168.1.100
My firewall has 2 NICs, one internal(192.168.1.1) and one external using
public IP(50.50.50.59).
I would like to allow users from the internet to
access my webserver. Since I configured webserver using private IP, internet
users can not access my webserver directly, that is why NAT is needed.
For
this example I have 2 scenarios doing NAT.
1.If I have limited public IP
address assigned to me by ISP
any http traffic from internet accessing to
firewallexternalIPaddress will be redirected to my webserver
internet user
port 80 ---> FW ext IP address --> Web server

In this case I don't need to
use additional IP address as an alias, because internet users will access my
website via: http://50.50.50.59
and the traffic will be redirected to the
webserver which is located inside LAN(192.168.1.100)

2.If I have spare public
IP address. this where IP alias can play the role.
I have another public IP
(let say 50.50.50.58) and I would like to assign it to webserver.
The
webserver is still located inside my LAN with IP 192.168.1.100. But I want to
assign the IP 50.50.50.58 only for application server services purpose,
because I don't want to mix it up with firewall service.
So the same concept
applies here.
any http traffic from internet accessing IP 50.50.50.58 will be
redirected to my webserver
internet user port 80 ---> 50.50.50.58 --> Web
server
As the 50.50.50.58 and 50.50.50.59 are within the same subnet ( and
also assigned for my business from ISP), then I need to assign it on the
external firewall interface. If I didn't assign it on the external firewall
interface, the http incoming traffic will not be able to pass through because
neither router nor firewall know how and where to redirect the incoming packet
and also neither router nor firewall take the ownership of 50.50.50.58
although 50.50.50.58 is assigned for my business by ISP. By assigning
50.50.50.58 on the external firewall interface as an IP alias, the firewall
will know how and where to redirect the incoming traffic.When the http traffic
on 50.50.50.58 is coming in, firewall will take the ownership,check the
routing table and then PF engine will check from the rule list whether the
incoming traffic to the webserver is alllowed or not. Once the rule is
matched, then the packet will be redirected to the destination. You can do
the
same by creating the rule for email server etc.internet user port 25 --->
50.50.50.58 --> my email server.

The same IP alias concept also applies if
you want to implement many to one NAT. For example to alllow your LAN users to
access internet access.
You can use IP alias or use firewall ext int IP as a
NAT IP. All depends on how your infra is configured and planned.
In which
scenario your setup is? If you're using 1st scenario, you don't need to use IP
alias, because the external ip addr for firewall which is accessed by the
public users for http traffic is belong to firewall. If you used 2nd
scenario, you will need to use IP alias configured on ext firewall interface.
Please also check the routing table in the router and the default gateway on
your destination node.

I hope it helps.

Regards,
Stefan
________________________________
From: Stefan Midjich <***@gmail.com>
To:
Stefan N <***@yahoo.com>
Cc: "***@openbsd.org" <***@openbsd.org>
Sent: Tuesday, October 11, 2011 1:25 PM
Subject: Re: Help setting up a PF NAT
gateway

No I was not aware of this. Could you please explain the meaning of
an
alias address on the external interface for NAT?

There is no mention of
using an alias for NAT in this document for
example
http://www.openbsd.org/faq/pf/nat.html

Just to be clear, I already have an
external and internal physical
interface to work with, so I am unclear as to
why I need an alias.

Post by Mark (obsd)
Hi

Stefan,

Post by Mark (obsd)
As you mentioned that the IP forwarding is already enabled on your system.
Have you configured the IP alias on the network interface for the NAT
purpose?
If the NAT is done on external interface then you'll need to

add in the IP

Post by Mark (obsd)
alias on /etc/hostname.vic2
Please read the guide from

openbsd url below:
http://www.openbsd.org/cgi-bin/man.cgi?query=hostname.if&apropos=0&sektion=0&
manpath=OpenBSD+4.9&arch=i386&format=html

Post by Mark (obsd)
Sample of hostname.if config with
A typical file contains only one line, but more extensive files are
inet 10.0.1.12 255.255.255.0

10.0.1.255 media 100baseTX description

Post by Mark (obsd)
Uplink
inet alias 10.0.1.13

255.255.255.255 10.0.1.13

Post by Mark (obsd)
inet alias 10.0.1.14 255.255.255.255 NONE

inet alias 10.0.1.15 255.255.255.255

Post by Mark (obsd)
inet alias 10.0.1.16

0xffffffff

Post by Mark (obsd)
# This is an example comment line.
inet6 alias

fec0::1 64

Post by Mark (obsd)
inet6 alias fec0::2 64 anycast
!route add

65.65.65.65 10.0.1.13

Post by Mark (obsd)
up
I hope it helps.
Regards,
Stefan

________________________________
Tuesday, October 11, 2011 2:06 AM

Post by Mark (obsd)
Subject: Re: Help setting up a PF NAT

gateway

Post by Mark (obsd)
Yes forwarding is enabled. I have followed the Book of PF 2nd

Edition so

Post by Mark (obsd)
far.

Hi

Stefan,

Post by Mark (obsd)

On Mon, Oct 10, 2011 at 10:38 AM, Stefan Midjich

Post by Stefan Midjich
Simplest of things but I'm failing

miserably.

Post by Mark (obsd)

Post by Stefan Midjich
...
With tcpdump I can see packets going to vic3,

but no further.

Post by Mark (obsd)

Do you definitely have forwarding enabled?
#

sysctl net.inet.ip.forwarding

Post by Mark (obsd)

net.inet.ip.forwarding=1
It that were 0

instead of 1, you'd get your symptoms. Edit

Post by Mark (obsd)
/etc/sysctl.conf

to enable

forwarding if you haven't.

Post by Mark (obsd)

Regards,
Mark

--
Med vdnliga

hdlsningar / With kind regards

Post by Mark (obsd)
Stefan Midjich

[Stefan Midjich]

It works now that I started over from scratch, I have a block in all
and a pass out all by default and NAT is working. I can see packets on
both in and out-interfaces with tcpdump. Of course ICMP response is
not being sent back since I have a block in all but at least NAT is
working and it is forwarding packets.

I think what I was missing, a crucial step and basic knowledge to any
networking tech, was the ins and the outs of gateways. I didn't
understand what Out or In was in the eyes of the gateway. I now
understand that Out is where the default gateway points, /etc/mygate,
in other words egress group in ifconfig. And In is of course the
opposite.

This is a very subtle detail but it made a WORLD of difference.

Thank you all for your support. :)

[Wesley M.]

Hi,

see my sample, it is well explained.
http://mouedine.net/ruleset49.aspx

All the best,

Wesley MOUEDINE ASSABY
www.mouedine.net

Post by Stefan Midjich
Simplest of things but I'm failing miserably.
$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255
$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two
machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255
For troubleshooting I have removed the block all rule, to confirm that
it is in fact my NAT related rules that don't work.
These are my first and only NAT rules. The other rules work fine and
are just to allow SSH to my management interface and ICMP response
from the external IP and from the internal gateway IP. Besides I've
removed the block all so the other rules don't matter much now.
match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
pass inet from 10.221.181.0/24 to any flags S/SA keep state
With tcpdump I can see packets going to vic3, but no further.
With block all commented out I can fully test the network around and
everything is working just fine, I can nc -kl 50.50.50.59 65535 and
connect to that port from anywhere on the internet. I just can't
connect out from the private network through the gateway. The systems
in the private network have 10.221.181.10 as their default gateway.
I even have the Book of PF 2nd edition here but it's of no use, the
rules are mostly from there. Just for troubleshooting I can also nc
-kl 10.221.181.10 65535 on the gateway and connect to that port from
the private network machines without issues.
So please tell me, what am I missing in this nat-to rule?
--
Med vdnliga hdlsningar / With kind regards
Stefan Midjich

[Stefan Midjich]

$ sudo pfctl -sr |grep nat-to
match in on vic3 inet from 10.221.181.0/24 to any label "NATOut"
nat-to (vic2) round-robin

pfctl -vsl shows only evaluated packets for all my rules, which
worries me, it never increments the counter of packets gone through
any of the nat rules. Only the first rules for management network and
of course the block rule when it was in place.

What does `pfctl -sr | grep nat-to` say?

Post by Stefan Midjich
Simplest of things but I'm failing miserably.
$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255
$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two
machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255
For troubleshooting I have removed the block all rule, to confirm that
it is in fact my NAT related rules that don't work.
These are my first and only NAT rules. The other rules work fine and
are just to allow SSH to my management interface and ICMP response
from the external IP and from the internal gateway IP. Besides I've
removed the block all so the other rules don't matter much now.
match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
pass inet from 10.221.181.0/24 to any flags S/SA keep state
With tcpdump I can see packets going to vic3, but no further.
With block all commented out I can fully test the network around and
everything is working just fine, I can nc -kl 50.50.50.59 65535 and
connect to that port from anywhere on the internet. I just can't
connect out from the private network through the gateway. The systems
in the private network have 10.221.181.10 as their default gateway.
I even have the Book of PF 2nd edition here but it's of no use, the
rules are mostly from there. Just for troubleshooting I can also nc
-kl 10.221.181.10 65535 on the gateway and connect to that port from
the private network machines without issues.
So please tell me, what am I missing in this nat-to rule?
--
Med vdnliga hdlsningar / With kind regards
Stefan Midjich

--
James Shupe, OSRE
developer/ engineer
BSD/ Linux Support | Metro Ethernet | Hosting
check out our site at www.osre.org

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich

[Peter N. M. Hansteen]

Post by Stefan Midjich
$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255
$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255

Are both of those those point to point links? I have a feeling this is
the source of your problem, see man ifconfig

[Stefan Midjich]

Not sure what you mean but they're both in switched vlans, two
different vlans. Point to Point is a crossover cable right? I'm not
sure what it means in English. This is all a virtual environment I use
for training so there are no cables as such.

Post by Peter N. M. Hansteen

Post by Stefan Midjich
$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255
$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255

Are both of those those point to point links? I have a feeling this is
the source of your problem, see man ifconfig
--
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich

[Peter N. M. Hansteen]

Post by Stefan Midjich
Not sure what you mean but they're both in switched vlans, two
different vlans. Point to Point is a crossover cable right? I'm not
sure what it means in English. This is all a virtual environment I use
for training so there are no cables as such.

take a step back. with PF disabled (pfctl -d), do you
have connectivity, does traffic pass where you want it to?

[Stefan Midjich]

I have taken away the block all rule, but pfctl -d makes no
difference. The gateway itself behaves just like any server connected
to multiple vlans. You can reach the world around it, through its
default gateway you can reach the internet.

The servers connected to its private vlan, vic3, cannot connect to
anything but themselves and the gateway ip 10.221.181.10. They cannot
go further. The gateway can ping them and connect to them just like on
a vlan.

Post by Peter N. M. Hansteen

Post by Stefan Midjich
Not sure what you mean but they're both in switched vlans, two
different vlans. Point to Point is a crossover cable right? I'm not
sure what it means in English. This is all a virtual environment I use
for training so there are no cables as such.

take a step back. with PF disabled (pfctl -d), do you
have connectivity, does traffic pass where you want it to?
--
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich

[Rodrigo Mosconi]

Post by Stefan Midjich
Simplest of things but I'm failing miserably.
$ sudo cat /etc/hostname.vic2 # External NIC with static public IPv4 address
inet 50.50.50.59 255.255.255.0 50.50.50.255
$ sudo cat /etc/hostname.vic3 # Internal NIC used as gateway by two
machines on same network
inet 10.221.181.10 255.255.255.0 10.221.181.255
For troubleshooting I have removed the block all rule, to confirm that
it is in fact my NAT related rules that don't work.
These are my first and only NAT rules. The other rules work fine and
are just to allow SSH to my management interface and ICMP response
from the external IP and from the internal gateway IP. Besides I've
removed the block all so the other rules don't matter much now.
match out on vic2 inet from 10.221.181.0/24 to any nat-to (vic2) round-robin
pass inet from 10.221.181.0/24 to any flags S/SA keep state

can be changed to

pass out on vic2 inet from 10.221.181.0/24 to any nat-to vic2

[Stefan Midjich]

I must say that thanks to your help on this list I've finally managed
to get it working. I have bought FreeBSD CD sets in the past as a
means to donate and I intend to buy 5.0 sets now because I believe
strongly in open source software.

Well it was also thanks to some pf.conf samples I found online from
4.7 and 4.8.

http://mouedine.net/ruleset49.aspx
http://serverfault.com/questions/175405/help-me-upgrade-my-pf-conf-for-openbsd-4-7

The only thing I have yet to solve is the ftp-proxy redirection. Here
is my current ruleset.

Here's my current pfctl -vf output.

block drop all
pass in quick on vic0 inet proto tcp from any to 10.220.100.0/24 port
= 1022 flags S/SA keep state label "PassInMGMTSSH"
pass in quick on vic0 inet proto tcp from any to 10.220.100.0/24 port
= ssh flags S/SA keep state label "PassInMGMTSSH"
pass out quick on vic0 inet proto tcp from 10.220.100.0/24 to any port
= 1022 flags S/SA keep state label "PassOutMGMTSSH"
pass out quick on vic0 inet proto tcp from 10.220.100.0/24 to any port
= ssh flags S/SA keep state label "PassOutMGMTSSH"
pass on vic0 proto udp from any to any port = domain keep state label
"PassMGMTDNS"
pass on vic0 inet proto icmp all icmp-type echorep keep state label
"PassMGMTICMP"
pass on vic0 inet proto icmp all icmp-type echoreq keep state label
"PassMGMTICMP"
pass on vic0 inet proto icmp all icmp-type unreach keep state label
"PassMGMTICMP"
pass quick on vic2 proto carp all keep state label "CUST-PassCarp"
pass quick on vic3 proto carp all keep state label "CUST-PassCarp"
pass in on vic2 inet proto icmp from any to 50.50.50.0/24 icmp-type
echoreq keep state label "CUST-PingOut"
pass in on vic2 inet proto icmp from any to 50.50.50.0/24 icmp-type
echorep keep state label "CUST-PingOut"
pass in on vic2 inet proto icmp from any to 50.50.50.0/24 icmp-type
unreach keep state label "CUST-PingOut"
pass in on vic3 inet proto icmp from 10.221.181.0/24 to 10.221.181.10
icmp-type echoreq keep state label "CUST-PingIn"
pass in on vic3 inet proto icmp from 10.221.181.0/24 to 10.221.181.10
icmp-type echorep keep state label "CUST-PingIn"
pass in on vic3 inet proto icmp from 10.221.181.0/24 to 10.221.181.10
icmp-type unreach keep state label "CUST-PingIn"
match out on vic2 inet from 10.221.181.10 to any nat-to (vic2) round-robin
match in on vic2 proto tcp from any to any port = smtp rdr-to
<CUST_FrontendPool> round-robin
match in on vic2 proto tcp from any to any port = www rdr-to
<CUST_FrontendPool> round-robin
match in on vic2 proto tcp from any to any port = ssh rdr-to
<CUST_FrontendPool> round-robin
match in on vic2 proto tcp from any to any port = 5222 rdr-to
<CUST_FrontendPool> round-robin
pass in on vic2 inet proto tcp from any to 10.221.181.21 port = smtp
flags S/SA keep state
pass in on vic2 inet proto tcp from any to 10.221.181.21 port = www
flags S/SA keep state
pass in on vic2 inet proto tcp from any to 10.221.181.21 port = ssh
flags S/SA keep state
pass in on vic2 inet proto tcp from any to 10.221.181.21 port = 5222
flags S/SA keep state
pass in on vic2 inet proto tcp from any to 10.221.181.22 port = smtp
flags S/SA keep state
pass in on vic2 inet proto tcp from any to 10.221.181.22 port = www
flags S/SA keep state
pass in on vic2 inet proto tcp from any to 10.221.181.22 port = ssh
flags S/SA keep state
pass in on vic2 inet proto tcp from any to 10.221.181.22 port = 5222
flags S/SA keep state
pass out on vic2 all flags S/SA keep state
pass on vic3 all flags S/SA keep state
anchor "ftp-proxy/*" all
pass in quick inet proto tcp from any to any port = ftp flags S/SA
keep state rdr-to 127.0.0.1 port 8021
pass out inet proto tcp from 127.0.0.1 to any port = ftp flags S/SA keep state

All of this works sans the ftp-proxy, it is listening on 8021 and I
get no errors in the syslog. Just a message that it started.

If I tcpdump -i lo0 I get no packets at all. I do see packets coming
in on the internal interface.

[Norman Golisz]

Hi Stefan,

Post by Stefan Midjich
I must say that thanks to your help on this list I've finally managed
to get it working. I have bought FreeBSD CD sets in the past as a
means to donate and I intend to buy 5.0 sets now because I believe
strongly in open source software.

really fine!

Post by Stefan Midjich
The only thing I have yet to solve is the ftp-proxy redirection. Here
is my current ruleset.
match out on vic2 inet from 10.221.181.10 to any nat-to (vic2) round-robin
pass out inet proto tcp from 127.0.0.1 to any port = ftp flags S/SA keep state
match out on vic2 inet all nat-to (vic2) round-robin

Good luck,
Norman

[Stefan Midjich]

After all that I was still doing NAT wrong, I thank you Norman! It
works perfectly now and it makes much more sense as NAT must be done
from the lo0 too out on the external IF.

Post by Mark (obsd)
Hi Stefan,

Post by Stefan Midjich
I must say that thanks to your help on this list I've finally managed
to get it working. I have bought FreeBSD CD sets in the past as a
means to donate and I intend to buy 5.0 sets now because I believe
strongly in open source software.

really fine!

Post by Stefan Midjich
The only thing I have yet to solve is the ftp-proxy redirection. Here
is my current ruleset.
match out on vic2 inet from 10.221.181.10 to any nat-to (vic2) round-robin
pass out inet proto tcp from 127.0.0.1 to any port = ftp flags S/SA keep state
match out on vic2 inet all nat-to (vic2) round-robin

Good luck,
Norman

--


Med vdnliga hdlsningar / With kind regards

Stefan Midjich