Network Prefix Translation (NPt) prefix translation bug
-
I think I found a bug that I can reliably reproduce, but I'm not quite sure what I'm looking at, so I haven't opened a redmine bug report yet. Any additional eyes to look over this would be helpful.
Firewall is running pfSense CE 2.7.2.
Internet ping host: 2001:db8:10a:23a7::1
LAN1 static IPv6: 2001:db8:2:1::/64
LAN2 static IPv6: 2001:db8:2:2::/64
LAN3 (ISP delegated prefix): 2001:db8:1:1::/64Here's the firewall rule on the WAN interface allowing inbound ICMP6 echo request to all IPv6 endpoints.
Pardon the following excel tables, I've only done it to sanitise the prefixes, but the main gist is still there.
What I was doing:
pinging my PC in LAN1 from the internet ping host outside my network using the ISP delegated prefix: 2001:db8:1:1:58bd:bbd3:cd6d:3909
When the LAN1 NPt mapping entry is at the very top, the ping packets can reach my PC.
State table filtered for the allow ICMP rule
When the LAN2 NPt mapping entry is moved before LAN1's entry, the ping packets no longer reaches my PC.
State table filtered for the allow ICMP rule
What I think is happening, is unsolicited inbound traffic with the ISP prefix (external prefix) is always translated to the internal prefix specified in the top most entry of the NPt mapping table, rather than the prefix for the proper subnet.
So far I've only tried this with ICMP6 Echo Request packets, so I can't say for certain it affects other types of packets as well.
Edit: Opened a redmine ticket
Edit 2: Not a bug.
-
@machbot That is true for everything, not only ping. NPt doesn't solve this problem (unsolicited inbound traffic) on pfSense.
-
@Bob-Dig said in Network Prefix Translation (NPt) prefix translation bug:
That is true for everything, not only ping.
It's good to know that the behavior isn't only for ICMP6 packets.
@Bob-Dig said in Network Prefix Translation (NPt) prefix translation bug:
NPt doesn't solve this problem (unsolicited inbound traffic) on pfSense.
Good to know. Perhaps I'll open a bug report on redmine for this issue, see what the devs have to say.
