• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Nat reflection and udp

Scheduled Pinned Locked Moved NAT
58 Posts 3 Posters 25.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    sullrich
    last edited by Sep 9, 2006, 8:34 PM

    Look in /var/etc/inetd.conf

    1 Reply Last reply Reply Quote 0
    • A
      aldo
      last edited by Sep 9, 2006, 8:53 PM

      gotyou

      /etc/inc/filter.inc
      ok line 844 has a case for udp that is empty
      there is another one a little lower than that.

      i am still looking for the rest of it.

      how much was the bounty for this scott can we afford to pay it was it a big one

      1 Reply Last reply Reply Quote 0
      • S
        sullrich
        last edited by Sep 9, 2006, 9:03 PM

        @aldo:

        gotyou

        /etc/inc/filter.inc
        ok line 844 has a case for udp that is empty
        there is another one a little lower than that.

        The same code handles tcp and udp.  This is normal for case type statements.

        @aldo:

        i am still looking for the rest of it.

        how much was the bounty for this scott can we afford to pay it was it a big one

        $1500

        1 Reply Last reply Reply Quote 0
        • S
          sullrich
          last edited by Sep 9, 2006, 9:13 PM

          aldo, please check out http://cvstrac.pfsense.com/chngview?cn=14258

          1 Reply Last reply Reply Quote 0
          • A
            aldo
            last edited by Sep 9, 2006, 9:28 PM

            ok one last question how do i reload the /tmp/rules.debug will come back to you tomorrow

            1 Reply Last reply Reply Quote 0
            • A
              aldo
              last edited by Sep 9, 2006, 9:46 PM

              sorted it looks impossible with the nc bit on the end.

              1 Reply Last reply Reply Quote 0
              • A
                aldo
                last edited by Sep 9, 2006, 9:52 PM

                think i have it scott

                19000 stream udp nowait/0 nobody /usr/bin/nc nc -w 20 192.168.200.200 161

                this nc needs a -u option to get udp

                as per

                http://www.openbsd.org/cgi-bin/man.cgi?query=nc&sektion=1&manpath=OpenBSD+3.9

                the only other error that i saw was to do with this line which you seem to be working on. this line always shows up tcp not udp

                pass in quick on $lan inet proto tcp from any to $loopback port 19000 keep state label "NAT REFLECT: Allow traffic to localhost"

                1 Reply Last reply Reply Quote 0
                • A
                  aldo
                  last edited by Sep 9, 2006, 10:44 PM Sep 9, 2006, 10:20 PM

                  line 919 fwrite($inetd_fd, "{$starting_localhost_port}\tstream\t{$protocol}\tnowait/0\tnobody\t/usr/bin/nc nc -w 20 {$target} {$loc_pt}\n");
                  change this to
                  fwrite($inetd_fd, "{$starting_localhost_port}\tstream\t{$protocol}\tnowait/0\tnobody\t/usr/bin/nc nc -w 20 -u {$target} {$loc_pt}\n");

                  the problem with this seems to be that this line even though the case is udpsets both tcp and udp streams???? i am sure you might know what this means

                  line 1891   $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                  change this to
                  $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";

                  hope it helps  alan

                  1 Reply Last reply Reply Quote 0
                  • S
                    sullrich
                    last edited by Sep 9, 2006, 10:43 PM

                    Please issue these commands to test:

                    fetch -o /etc/inc/ http://www.pfsense.com/~sullrich/filter.inc
                    /etc/rc.filter_configure

                    1 Reply Last reply Reply Quote 0
                    • A
                      aldo
                      last edited by Sep 9, 2006, 10:59 PM

                      switch($rule['protocol']) {
                                                                                              case "tcp/udp":
                                                                                                      $protocol = "{ tcp udp }";
                                                                                                      $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                      $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                      break;
                                                                                              case "tcp":
                                                                                              case "udp":
                                                                                                      $protocol = $rule['protocol'];
                                                                                                      $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                      break;
                                                                                              default:
                                                                                                      break;
                                                                                      }

                      **You need to add the case for tcp otherwise tcp get udp case set

                      the stream looks good but the local host rule needs the tcp case filled in i tested this and it worked fine
                                                                                              case "tcp":
                                                                                                      $protocol = $rule['protocol'];
                                                                                                      $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                      break**;

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by Sep 9, 2006, 11:00 PM

                        There is no break, it automatically hits the next case.

                        1 Reply Last reply Reply Quote 0
                        • A
                          aldo
                          last edited by Sep 9, 2006, 11:00 PM

                          ok sorry i just stripped you code when pasting not mine

                          1 Reply Last reply Reply Quote 0
                          • A
                            aldo
                            last edited by Sep 9, 2006, 11:03 PM

                            one last thing you have an extra white space on the udp stream now.
                            i did them both in clean cases before and all worked well

                            for the inetd i added info the the tcp case and the upd case as i did in the localhost allow rule your
                            solution was definatly neater but there is a whitespace issue

                            1 Reply Last reply Reply Quote 0
                            • S
                              sullrich
                              last edited by Sep 9, 2006, 11:03 PM

                              Please test the file that I posted.  It really should be working now.

                              1 Reply Last reply Reply Quote 0
                              • S
                                sullrich
                                last edited by Sep 9, 2006, 11:03 PM

                                @aldo:

                                one last thing you have an extra white space on the udp stream now.
                                i did them both in clean cases before and all worked well

                                for the inetd i added info the the tcp case and the upd case as i did in the localhost allow rule your
                                solution was definatly neater but there is a whitespace issue

                                Not sure what you mean.  Please show me either the generated rules from rules.debug or the netcat entries from inetd.conf

                                1 Reply Last reply Reply Quote 0
                                • A
                                  aldo
                                  last edited by Sep 9, 2006, 11:06 PM

                                  19000 stream udp nowait/0 nobody /usr/bin/nc nc  -u -w 20 192.168.200.200 161
                                  19002 stream tcp nowait/0 nobody /usr/bin/nc nc -w 20 192.168.200.200 8000

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    sullrich
                                    last edited by Sep 9, 2006, 11:08 PM

                                    Yeah it doesn't look "good" but it should work..

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      aldo
                                      last edited by Sep 9, 2006, 11:11 PM

                                      NAT Reflection rules

                                      pass in quick on $lan inet proto udp from any to $loopback port 19000 keep state
                                      label "NAT REFLECT: Allow traffic to localhost"
                                      pass in quick on $lan inet proto udp from any to $loopback port 19001 keep state
                                      label "NAT REFLECT: Allow traffic to localhost"

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        aldo
                                        last edited by Sep 9, 2006, 11:12 PM

                                        /* $Id: filter.inc,v 1.575.2.248 2006/09/09 22:53:48 sullrich Exp $ */

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          aldo
                                          last edited by Sep 9, 2006, 11:14 PM

                                          this definatly works correctly here

                                          switch($rule['protocol']) {
                                                                                                                  case "tcp/udp":
                                                                                                                          $protocol = "{ tcp udp }";
                                                                                                                          $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                                          $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                                          break;
                                                                                                                  case "tcp":
                                                                                                                          $protocol = $rule['protocol'];
                                                                                                                          $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                                          break;
                                                                                                                  case "udp":
                                                                                                                          $protocol = $rule['protocol'];
                                                                                                                          $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                                          break;
                                                                                                                  default:
                                                                                                                          break;
                                                                                                          }

                                          NAT Reflection rules

                                          pass in quick on $lan inet proto udp from any to $loopback port 19000 keep state
                                          label "NAT REFLECT: Allow traffic to localhost"
                                          pass in quick on $lan inet proto tcp from any to $loopback port 19001 keep state
                                          label "NAT REFLECT: Allow traffic to localhost"

                                          1 Reply Last reply Reply Quote 0
                                          24 out of 58
                                          • First post
                                            24/58
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received