NAT protocol; any way to set something other than in dropdown?

johnpoz

@macncheeseb said in NAT protocol; any way to set something other than in dropdown?:

SCTP

can you not just tunnel it over UDP port?

https://tools.ietf.org/html/rfc6951
UDP Encapsulation of Stream Control Transmission Protocol (SCTP) Packets for End-Host to End-Host Communication

macNCheeseB

@johnpoz Thanks for the response. I will look at that document to see if here is something I can use. My first thought is I have tried workarounds like this before,but run into issues with NAT'ing. If there is any hiding of addresses within other protocols, the NAT only goes one level deep. But I'll look.

macNCheeseB

@johnpoz So looking at that RFC and doing some searching shows that UDP encapsulation it is not something that is native to most OSs, including Linux (which I am using). There are some third party SW implementations that promise to do that for anybody needing it but most are still immature or no longer supported from what I can see. So I don't think that is really a feasible solution. Is there no way to manually set the protocol number to filter on in pfsense?

johnpoz

@jimp would prob be the best guy to answer such a question. I really have almost zero experience with sctp.. To be honest other than reading some info on it - I have never really seen it in production.

Lets see if jim notices his page and joins us.. I think its a bit more complicated then just adding the protocol number to the dropdown list ;)

If the underlaying stuff is there then sure they could add that to the dropdown list.

macNCheeseB

@johnpoz OK, thanks for the response. Hopefully @jimp can jump in with some advice.

jimp

You'd have to edit the source code to add the protocol, or setup 1:1 NAT so everything gets forwarded.

macNCheeseB

@jimp Thanks for the response. So no real way to support anything other than what is in the drop down generically. I don't really like the 1:1 option, but I will explore that and see if it gets me what I need.

macNCheeseB

@jimp, @johnpoz I have a 1:1 NAT in place and I can see that SSH traffic gets passed between the two IPs, but it is still blocking SCTP traffic. Is there a specific option to allow all protocols on the 1:1 NAT?

jimp

1:1 NAT always forwards all protocols. Perhaps you didn't allow it with firewall rules? 1:1 NAT doesn't add firewall rules automatically like port forwards do.

macNCheeseB

@jimp That was it. Had to allow the traffic through the firewall. Thanks for the help, I think this will get me what I need for now.