From nobody@FreeBSD.org  Sun Aug  2 09:02:54 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 56BC4106564A
	for <freebsd-gnats-submit@FreeBSD.org>; Sun,  2 Aug 2009 09:02:54 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id E8ADA8FC13
	for <freebsd-gnats-submit@FreeBSD.org>; Sun,  2 Aug 2009 09:02:53 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n7292rje038200
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 2 Aug 2009 09:02:53 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n7292rKS038198;
	Sun, 2 Aug 2009 09:02:53 GMT
	(envelope-from nobody)
Message-Id: <200908020902.n7292rKS038198@www.freebsd.org>
Date: Sun, 2 Aug 2009 09:02:53 GMT
From: Dmitriy Demidov <dima_bsd@inbox.lv>
To: freebsd-gnats-submit@FreeBSD.org
Subject: ipfw nat redirect_proto is broken
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         137346
>Category:       kern
>Synopsis:       [ipfw] ipfw nat redirect_proto is broken
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-ipfw
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Aug 02 09:10:02 UTC 2009
>Closed-Date:    
>Last-Modified:  Sun Aug 02 10:13:46 UTC 2009
>Originator:     Dmitriy Demidov
>Release:        FreeBSD 7.2-STABLE
>Organization:
>Environment:
FreeBSD hius.local.home 7.2-STABLE FreeBSD 7.2-STABLE #0: Sun Jul 19 13:01:10 EEST 2009     root@hius.local.home:/usr/obj/usr/src/sys/STABLE  i386
>Description:
Looks like redirect_proto in ipfw nat is broken.

I have NAT router with following config:
fxp0 - LAN (192.168.1.1)
em0 - WAN (8.9.0.100)

# ipfw show
00100 214 45088 allow ip from any to any via lo0
00200   0     0 deny ip from any to 127.0.0.0/8
00300   0     0 deny ip from 127.0.0.0/8 to any
00400   2   100 count ip from any to any
00500   0     0 allow ip from any to any via fxp0
00600   2   100 count ip from any to any
00700   2   100 nat 1 log logamount 100 ip from any to any via em0
00800   0     0 count ip from any to any
65535   0     0 deny ip from any to any

# ipfw nat 1 show
nat 1: icmp=0, udp=0, tcp=2, pptp=0, proto=0, frag_id=0 frag_ptr=0 / tot=2

# ipfw nat 1 show config
ipfw nat 1 config log redirect_proto tcp 192.168.1.2 8.9.0.100



On NAT router I don not have SSH daemon running. If I make a try to connect to 192.168.1.2 SSH (81.91.0.122 -> 8.9.0.100:22) from Internet via redirect_proto I got error:

tcpdump -i 2 -vvv -n -l ip
tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes
22:27:35.459508 IP (tos 0x0, ttl 64, id 51316, offset 0, flags [DF], proto TCP (6), length 60) 81.91.0.122.35654 > 8.9.0.100.22: S, cksum 0x6bc2 (correct), 2918273360:2918273360(0) win 5840 <mss 1460,sackO
K,timestamp 1743140 0,nop,wscale 6>
22:27:35.459638 IP (tos 0x0, ttl 64, id 298, offset 0, flags [DF], proto TCP (6), length 40) 8.9.0.100.22 > 81.91.0.122.35654: R, cksum 0x839f (correct), 0:0(0) ack 2918273361 win 0

So looks like redirect_proto do not works as expected here - it passes all incoming traffic into local machine (it do not alter destination IP address of packet as expected).
>How-To-Repeat:
Make a try to use redirect_proto in any ipfw nat configuration.
>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-ipfw 
Responsible-Changed-By: remko 
Responsible-Changed-When: Sun Aug 2 09:52:25 UTC 2009 
Responsible-Changed-Why:  
Over to maintainer. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=137346 
>Unformatted:
