From nobody@FreeBSD.org  Wed May 31 01:17:17 2006
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2B1F016A618
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 31 May 2006 01:17:17 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id DECC543D4C
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 31 May 2006 01:17:16 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k4V1HGk5070124
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 31 May 2006 01:17:16 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id k4V1HGBK070123;
	Wed, 31 May 2006 01:17:16 GMT
	(envelope-from nobody)
Message-Id: <200605310117.k4V1HGBK070123@www.freebsd.org>
Date: Wed, 31 May 2006 01:17:16 GMT
From: Steven Baker <msbaker@cs.uoregon.edu>
To: freebsd-gnats-submit@FreeBSD.org
Subject: ipfw add pass 224.0.0.0/4 multicast rule prevents natd forwarding for dynamic rules
X-Send-Pr-Version: www-2.3

>Number:         98184
>Category:       kern
>Synopsis:       [ipfw] ipfw add pass 224.0.0.0/4 multicast rule prevents natd forwarding for dynamic rules
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    oleg
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 31 01:20:13 GMT 2006
>Closed-Date:    Mon Mar 05 21:37:18 GMT 2007
>Last-Modified:  Mon Mar 05 21:37:18 GMT 2007
>Originator:     Steven Baker
>Release:        FreeBSD 6.0 RTM kernel build with some components removed and others added
>Organization:
>Environment:
FreeBSD firewall 6.0-RELEASE-p3 FreeBSD 6.0-RELEASE-p3 #0: Sun Jan 22 22:34:41 PST 2006     root@firewall:/usr/obj/usr/src/sys/FIREWALL601  i386

>Description:
I have a subset of IPFW rules that deal questionable IP addresses. I have been using these same rules on FreeBSD firewalls since probably FreeBSD 3.1.

The rules in question are as follows where:
  oif = the outside network interface
  iif = the internal network interface
  inet = the internal network (192.168.0.0, for example)
  imask = the internal network mask (255.255.255.0, for example)

        # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
        # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
        # on the outside interface
        ${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
        ${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
        ${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
        # Stop Class D
        ${fwcmd} add deny log all from any to 224.0.0.0/4 via ${oif}
        # Stop Class E
        ${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}

This same block of rules is repeated before and after the NATD rule

I also have a set of rules after the NATD rule to allow DNS queries to a bunch of known DNS servers:

     # Allow DNS queries out to our primary DNS Servers, all from firewall
        ${fwcmd} add pass udp from any to ${dns1} 53 keep-state
        ${fwcmd} add pass udp from any to ${dns2} 53 keep-state
        etc ...  

Because of some other issues, I changed the Class D rule to allow multicast packets both before and after NATD.

        # Allow Class D
        ${fwcmd} add pass log all from any to 224.0.0.0/4 via ${oif} keep-state

I also added the following rule after NATD

        ${fwcmd} add pass log all from ${inet}${imask} to 224.0.0.0/4 via ${iif}
 keep-state


Once these changes were made, dns queries from the firewall machine worked but all dns queries from behind the firewall failed. TCP connections to
an external IP address (http://72.5.124.61 which is www.sun.com) would still work and traverse the firewall/gateway. But the DNS queries/responses did not appear to traverse the firewall/gateway. My best guess not looking at the source code is that having an allow rule for multicast D addresses with keep-state somehow interfered with the DNS queries keep-state rules and the dynamic rules that were created.

After issuing an nslookup from a client machine behind the firewall, I could see that an appropriate dynamic rule was created using "ipfw -ad show" (output not enclosed). 

In troubleshooting, I added a rule at the beginniing of the ruleset so that I would see all packets:

   ipfw add 333 count log all ip from any to any



From the firewall log (note I have replaced addresses with symbolic names)


nslookup request from firewall machine that works:

May 30 11:00:52 firewall kernel: ipfw: 333 Count UDP ${oip}:60915 ${dns1}:53 out via ${oif}
May 30 11:00:53 firewall kernel: ipfw: 333 Count UDP ${dns1}:53 192.168.186.
1:60915 in via ${oif}

nslookup from behind firewall machine that fails

May 30 10:59:51 firewall kernel: ipfw: 333 Count UDP ${client1}:1066 ${dns1}:53 in via ${iif}


Note that there were no multicast packets logged. Just changing the rule appears to cause this problem.



>How-To-Repeat:
Add the following rules on a firewall machine running FreeBSD 6.0 using natd and ipfw2

  # Allow Class D
  ${fwcmd} add pass log all from any to 224.0.0.0/4 via ${oif} keep-state
  ${fwcmd} add pass log all from ${inet}${imask} to 224.0.0.0/4 via ${iif}
      keep-state

This machine should also have some rules to allow queries to known name servers after the NATD rule and the above rules:
  # Allow DNS queries out to our primary DNS Servers, all from firewall
  ${fwcmd} add pass udp from any to ${dns1} 53 keep-state
  ${fwcmd} add pass udp from any to ${dns2} 53 keep-state
  etc ...  


Try a dns query from behind the firewall machine and it should fail.


>Fix:

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-ipfw 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Sat Jun 3 19:03:54 UTC 2006 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=98184 
Responsible-Changed-From-To: freebsd-ipfw->oleg 
Responsible-Changed-By: oleg 
Responsible-Changed-When: Thu Jun 8 20:45:05 UTC 2006 
Responsible-Changed-Why:  
take over. 


http://www.freebsd.org/cgi/query-pr.cgi?pr=98184 
State-Changed-From-To: open->feedback 
State-Changed-By: oleg 
State-Changed-When: Thu Jun 8 20:45:35 UTC 2006 
State-Changed-Why:  
Could you please try following: 
Convert your rule: 
${fwcmd} add pass log all from any to 224.0.0.0/4 via ${oif} keep-state 
which is _before_ diverting (to natd) rule to: 
1) stateless rule (i.e. remove keep-state option). 
Does it solve your problem? 

2) try to use this rule instead: 
${fwcmd} add skipto N log all from any to 224.0.0.0/4 via ${oif} keep-state 
where N is number of your diverting rule. 
Does it solve your problem? 


http://www.freebsd.org/cgi/query-pr.cgi?pr=98184 
State-Changed-From-To: feedback->closed 
State-Changed-By: oleg 
State-Changed-When: Mon Mar 5 21:36:21 UTC 2007 
State-Changed-Why:  
No feedback in 8 months. 


http://www.freebsd.org/cgi/query-pr.cgi?pr=98184 
>Unformatted:
