Re: pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work"

From: Julian Elischer (julian_at_elischer.org)
Date: 07/30/03

Next message: Michael Sierchio: "Re: Help with FreeBSD Bridged Firewall"

Previous message: Rocco Caputo: "pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
In reply to: Rocco Caputo: "pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
Next in thread: Rocco Caputo: "Re: pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
Reply: Rocco Caputo: "Re: pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Date: Wed, 30 Jul 2003 12:51:32 -0700 (PDT)
To: Rocco Caputo <rcaputo@pobox.com>

You are complicating things by running both ipfw and ipf.
can you not do just one of them?

On Wed, 30 Jul 2003, Rocco Caputo wrote:

> [Originally posted to freebsd-questions, but someone suggested
> freebsd-net instead.]
>
> I've acquired DSL. My modem's PPPoE and NAT have a tendency to remap
> ports, so I switched it to bridged Ethernet. Now I'm using ppp(8) for
> PPPoE. I'm using ipfw2 for QOS things (pipes and queues). I'm using
> ipf for firewalling and ftp proxying.
>
> Almost everything works well, except (so far) active FTP and pinging the
> tun0 interface.
>
> tcpdump shows ICMP echo requests and responses, but ping does not see
> them. Opening ipf (pass in all, pass out all) "fixes" ping.
>
> ipfnat's active ftp proxy sees the PORT request and punches a hole
> through the firewall, but incoming packets don't arrive. Opening ipf
> "fixes" this, too.
>
> Other incoming connections seem to work fine. DNS works fine. TCP
> works fine.
>
> I've read the handbook, the howtos, searched the list archives, usenet,
> and the web. Nothing solved it.
>
> So. What have I overlooked? Where have I gone wrong? Would you like
> to see my cling-film collection? How about an extensive (but perhaps
> not exhaustive) collection of excerpts from my system configuration
> files? Ok, it is included.
>
> --
> Rocco Caputo - rcaputo@pobox.com - http://poe.perl.org/
>
> === ppp.conf
>
> default:
> ident user-ppp VERSION (built COMPILATIONDATE)
> set log CBCP CCP Chat Connect Command IPCP tun Phase Warning
>
> papchap:
> add default HISADDR
> disable ipv6cp
> disable vjcomp
> enable iface-alias
> enable lqr
> enable tcpmssfixup
> nat enable yes
> nat log yes
> nat same_ports yes
> set authkey *****
> set authname *****
> set cd 5
> set crtscts off
> set device PPPoE:dc0
> set dia
> set ifaddr 68.213.211.142/0 192.168.36.176/0
> set login
> set lqrperiod 1
> set mru 1492
> set mtu 1492
> set redial 1 0
> set server /var/run/tun0 "" 0177
> set speed sync
> set timeout 0
>
> === netstat -rn
>
> Routing tables
>
> Internet:
> Destination Gateway Flags Refs Use Netif Expire
> default 192.168.36.176 UGSc 80 1377475 tun0
> 10 link#2 UC 4 0 rl0
> 10.0.0.7 link#2 UHLW 0 8 rl0
> 10.0.0.18 00:e0:18:0b:ac:22 UHLW 1 115334 rl0 303
> 10.0.0.25 00:e0:18:30:68:32 UHLW 0 292874 lo0
> 10.0.0.100 00:e0:18:30:65:f6 UHLW 1 111019 rl0 163
> 127.0.0.1 127.0.0.1 UH 6 196295 lo0
> 192.168.1 link#1 UC 2 0 dc0
> 192.168.1.25 00:04:5a:59:8e:92 UHLW 0 142112 lo0
> 192.168.1.254 00:60:0f:31:c7:86 UHLW 0 75153 dc0 865
> 192.168.36.176 68.213.211.142 UH 76 71059 tun0
>
> === ipfstat -i
>
> block in quick on tun0 from 0.0.0.0/8 to any
> block in quick on tun0 from 127.0.0.0/8 to any
> block in quick on tun0 from 169.254.0.0/16 to any
> block in quick on tun0 from 172.16.0.0/12 to any
> block in quick on tun0 from 192.0.2.0/24 to any
> block in quick on tun0 from 192.168.0.0/16 to any
> block in quick on tun0 from 224.0.0.0/4 to any
> block in quick on tun0 from 240.0.0.0/4 to any
> pass in quick on lo0 from any to any
> pass in quick on rl0 from any to any
> pass in quick on dc0 from any to any
> pass in quick on tun0 proto tcp from any to any port = 80 flags S/FSRPAU keep state keep frags
> pass in quick on tun0 proto tcp from any to any port = 113 flags S/FSRPAU keep state keep frags
> pass in quick on tun0 proto tcp from any to any port = 433 flags S/FSRPAU keep state keep frags
> pass in quick on tun0 proto tcp from any to any port 6881 >< 6999 flags S/FSRPAU keep state keep frags
> pass in quick on tun0 proto tcp from any to any port = 11512 flags S/FSRPAU keep state keep frags
> pass in quick on tun0 proto tcp from any to any port 32000 >< 32100 flags S/FSRPAU keep state keep frags
> block in quick from any to any
>
> === ipfstat -o
>
> block out quick on tun0 from 0.0.0.0/8 to any
> block out quick on tun0 from 127.0.0.0/8 to any
> block out quick on tun0 from 169.254.0.0/16 to any
> block out quick on tun0 from 172.16.0.0/12 to any
> block out quick on tun0 from 192.0.2.0/24 to any
> block out quick on tun0 from 192.168.0.0/16 to any
> block out quick on tun0 from 224.0.0.0/4 to any
> block out quick on tun0 from 240.0.0.0/4 to any
> pass out quick on lo0 from any to any
> pass out quick on rl0 from any to any
> pass out quick on dc0 from any to any
> pass out quick on tun0 proto icmp from any to any keep state
> pass out quick on tun0 proto tcp from any to any flags S/FSRPAU keep state keep frags
> pass out quick on tun0 proto udp from any to any keep state keep frags
> block out quick from any to any
>
> === ipnat -l
>
> List of active MAP/Redirect filters:
> map tun0 68.213.211.142/32 -> 68.213.211.142/32 proxy port ftp ftp/tcp
>
> List of active sessions:
> (none)
>
> === various rc.conf bits
>
> ifconfig_dc0="inet 192.168.1.25 netmask 255.255.255.0"
> network_interfaces="lo0 rl0 dc0 tun0"
>
> firewall_enable="YES"
> firewall_logging="YES"
> firewall_type="/etc/rc.firewall.custom"
> firewall_flags="-p /usr/bin/cpp"
>
> ipfilter_enable="YES"
> ipfilter_program="/sbin/ipf"
> ipfilter_rules="/etc/ipf.rules"
>
> ipnat_enable="YES"
>
> ppp_enable="yes"
> ppp_mode="ddial"
> ppp_nat="yes"
> ppp_profile="papchap"
>
> === ipfw show
>
> 01110 queue 18 icmp from any to any in via tun0
> 01110 queue 18 ip from any to any in via tun0 iptos lowdelay,throughput
> 01120 queue 18 tcp from any to any in via tun0 tcpflags ack
> 01120 queue 18 tcp from any to any in via tun0 tcpflags ack
> 01300 queue 14 ip from any to any in via tun0 iptos lowdelay
> 01310 queue 14 tcp from any 6666-6669 to any in via tun0
> 01320 queue 14 tcp from any 80 to any in via tun0
> 01400 queue 11 tcp from any 119 to any in via tun0
> 01410 queue 11 tcp from any 5999 to any in via tun0
> 01420 queue 11 tcp from any to any in via tun0 iplen 1500
> 01430 queue 11 tcp from any 6881-6889 to any in via tun0
> 01440 queue 11 tcp from any to any dst-port 6881-6889 in via tun0
> 01900 queue 12 ip from any to any in via tun0
> 02100 queue 28 icmp from any to any out via tun0
> 02110 queue 28 ip from any to any out via tun0 iptos lowdelay,throughput
> 02120 queue 28 tcp from any to any out via tun0 tcpflags ack
> 02130 queue 28 tcp from any to any out via tun0 setup
> 02300 queue 24 ip from any to any out via tun0 iptos lowdelay
> 02310 queue 24 tcp from any to any dst-port 6666-6669 out via tun0
> 02400 queue 21 tcp from any 80 to any out via tun0
> 02410 queue 21 tcp from any 443 to any out via tun0
> 02420 queue 21 tcp from any 11512 to any out via tun0
> 02430 queue 21 tcp from any to any dst-port 119 out via tun0
> 02440 queue 21 tcp from any to any dst-port 5999 out via tun0
> 02450 queue 21 tcp from any to any out via tun0 iplen 1500
> 02460 queue 21 tcp from any 6881-6889 to any out via tun0
> 02470 queue 21 tcp from any to any dst-port 6881-6889 out via tun0
> 02900 queue 22 ip from any to any out via tun0
> 60000 allow ip from any to any via lo0
> 60010 allow ip from any to any via rl0
> 60020 allow ip from any to any via dc0
> 60030 allow ip from any to any via tun0
> 60040 allow ip from any to any
> 65535 deny ip from any to any
>
> === ipfw queue show
>
> 00010: 368.000 Kbit/s 0 ms 36 KB 0 queues (1 buckets) droptail
> mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
> 00011: 736.000 Kbit/s 0 ms 73 KB 0 queues (1 buckets) droptail
> mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
> 00012: 1.472 Mbit/s 0 ms 147 KB 0 queues (1 buckets) droptail
> mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
> 00020: 64.000 Kbit/s 0 ms 6144 B 0 queues (1 buckets) droptail
> mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
> 00021: 128.000 Kbit/s 0 ms 12 KB 0 queues (1 buckets) droptail
> mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
> 00022: 256.000 Kbit/s 0 ms 25 KB 0 queues (1 buckets) droptail
> mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
>
> === end
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
>

_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

Next message: Michael Sierchio: "Re: Help with FreeBSD Bridged Firewall"

Previous message: Rocco Caputo: "pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
In reply to: Rocco Caputo: "pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
Next in thread: Rocco Caputo: "Re: pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
Reply: Rocco Caputo: "Re: pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Relevant Pages

Multiple Default Gateways using DIVERT
... My company has a single DSL line through which I have set up internet access ... via NAT using IPF. ... am not all that clear on divert's use in varying gateways. ...
(FreeBSD-Security)
Re: Q: ipf
... > Is there any equivalent for ipf? ... > I would like to use NAT with something like this: ... AFAIK there isn't a 'me' equivalent for use with dynamic addresses... ... Nicholas Harripersad ...
(comp.unix.bsd.freebsd.misc)
Re: Multiple Default Gateways using DIVERT
... > My company has a single DSL line through which I have set up internet access ... > via NAT using IPF. ... > am not all that clear on divert's use in varying gateways. ...
(FreeBSD-Security)
Re: [Newbie] Migrating from RedHat to FreeBSD
... > ipf and ipnat packages to provide NAT and firewall for my box. ... member of the first RFC 1149 implementation team ...
(comp.unix.bsd.freebsd.misc)