Nat reflection and udp

sullrich · Sep 9, 2006, 8:34 PM

Look in /var/etc/inetd.conf

aldo · Sep 9, 2006, 8:53 PM

gotyou

/etc/inc/filter.inc
ok line 844 has a case for udp that is empty
there is another one a little lower than that.

i am still looking for the rest of it.

how much was the bounty for this scott can we afford to pay it was it a big one

sullrich · Sep 9, 2006, 9:03 PM

@aldo:

gotyou

/etc/inc/filter.inc
ok line 844 has a case for udp that is empty
there is another one a little lower than that.

The same code handles tcp and udp. This is normal for case type statements.

@aldo:

i am still looking for the rest of it.

how much was the bounty for this scott can we afford to pay it was it a big one

$1500

sullrich · Sep 9, 2006, 9:13 PM

aldo, please check out http://cvstrac.pfsense.com/chngview?cn=14258

aldo · Sep 9, 2006, 9:28 PM

ok one last question how do i reload the /tmp/rules.debug will come back to you tomorrow

aldo · Sep 9, 2006, 9:46 PM

sorted it looks impossible with the nc bit on the end.

aldo · Sep 9, 2006, 9:52 PM

think i have it scott

19000 stream udp nowait/0 nobody /usr/bin/nc nc -w 20 192.168.200.200 161

this nc needs a -u option to get udp

as per

http://www.openbsd.org/cgi-bin/man.cgi?query=nc&sektion=1&manpath=OpenBSD+3.9

the only other error that i saw was to do with this line which you seem to be working on. this line always shows up tcp not udp

pass in quick on $lan inet proto tcp from any to $loopback port 19000 keep state label "NAT REFLECT: Allow traffic to localhost"

aldo · Sep 9, 2006, 10:44 PM

line 919 fwrite($inetd_fd, "{$starting_localhost_port}\tstream\t{$protocol}\tnowait/0\tnobody\t/usr/bin/nc nc -w 20 {$target} {$loc_pt}\n");
change this to
fwrite($inetd_fd, "{$starting_localhost_port}\tstream\t{$protocol}\tnowait/0\tnobody\t/usr/bin/nc nc -w 20 -u {$target} {$loc_pt}\n");

the problem with this seems to be that this line even though the case is udpsets both tcp and udp streams???? i am sure you might know what this means

line 1891 $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
change this to
$ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";

hope it helps alan

sullrich · Sep 9, 2006, 10:43 PM

Please issue these commands to test:

fetch -o /etc/inc/ http://www.pfsense.com/~sullrich/filter.inc
/etc/rc.filter_configure

aldo · Sep 9, 2006, 10:59 PM

switch($rule['protocol']) {
case "tcp/udp":
$protocol = "{ tcp udp }";
$ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
$ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
break;
case "tcp":
case "udp":
$protocol = $rule['protocol'];
$ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
break;
default:
break;
}

**You need to add the case for tcp otherwise tcp get udp case set

the stream looks good but the local host rule needs the tcp case filled in i tested this and it worked fine
case "tcp":
$protocol = $rule['protocol'];
$ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
break**;

sullrich · Sep 9, 2006, 11:00 PM

There is no break, it automatically hits the next case.

aldo · Sep 9, 2006, 11:00 PM

ok sorry i just stripped you code when pasting not mine

aldo · Sep 9, 2006, 11:03 PM

one last thing you have an extra white space on the udp stream now.
i did them both in clean cases before and all worked well

for the inetd i added info the the tcp case and the upd case as i did in the localhost allow rule your
solution was definatly neater but there is a whitespace issue

sullrich · Sep 9, 2006, 11:03 PM

Please test the file that I posted. It really should be working now.

sullrich · Sep 9, 2006, 11:03 PM

@aldo:

one last thing you have an extra white space on the udp stream now.
i did them both in clean cases before and all worked well

for the inetd i added info the the tcp case and the upd case as i did in the localhost allow rule your
solution was definatly neater but there is a whitespace issue

Not sure what you mean. Please show me either the generated rules from rules.debug or the netcat entries from inetd.conf

aldo · Sep 9, 2006, 11:06 PM

19000 stream udp nowait/0 nobody /usr/bin/nc nc -u -w 20 192.168.200.200 161
19002 stream tcp nowait/0 nobody /usr/bin/nc nc -w 20 192.168.200.200 8000

sullrich · Sep 9, 2006, 11:08 PM

Yeah it doesn't look "good" but it should work..

aldo · Sep 9, 2006, 11:11 PM

NAT Reflection rules

pass in quick on $lan inet proto udp from any to $loopback port 19000 keep state
label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $lan inet proto udp from any to $loopback port 19001 keep state
label "NAT REFLECT: Allow traffic to localhost"

aldo · Sep 9, 2006, 11:12 PM

/* $Id: filter.inc,v 1.575.2.248 2006/09/09 22:53:48 sullrich Exp $ */

aldo · Sep 9, 2006, 11:14 PM

this definatly works correctly here

switch($rule['protocol']) {
case "tcp/udp":
$protocol = "{ tcp udp }";
$ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
$ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
break;
case "tcp":
$protocol = $rule['protocol'];
$ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
break;
case "udp":
$protocol = $rule['protocol'];
$ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
break;
default:
break;
}

NAT Reflection rules

pass in quick on $lan inet proto udp from any to $loopback port 19000 keep state
label "NAT REFLECT: Allow traffic to localhost"
pass in quick on $lan inet proto tcp from any to $loopback port 19001 keep state
label "NAT REFLECT: Allow traffic to localhost"