• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Nat reflection and udp

Scheduled Pinned Locked Moved NAT
58 Posts 3 Posters 25.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A
    aldo
    last edited by Sep 9, 2006, 10:44 PM Sep 9, 2006, 10:20 PM

    line 919 fwrite($inetd_fd, "{$starting_localhost_port}\tstream\t{$protocol}\tnowait/0\tnobody\t/usr/bin/nc nc -w 20 {$target} {$loc_pt}\n");
    change this to
    fwrite($inetd_fd, "{$starting_localhost_port}\tstream\t{$protocol}\tnowait/0\tnobody\t/usr/bin/nc nc -w 20 -u {$target} {$loc_pt}\n");

    the problem with this seems to be that this line even though the case is udpsets both tcp and udp streams???? i am sure you might know what this means

    line 1891   $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
    change this to
    $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";

    hope it helps  alan

    1 Reply Last reply Reply Quote 0
    • S
      sullrich
      last edited by Sep 9, 2006, 10:43 PM

      Please issue these commands to test:

      fetch -o /etc/inc/ http://www.pfsense.com/~sullrich/filter.inc
      /etc/rc.filter_configure

      1 Reply Last reply Reply Quote 0
      • A
        aldo
        last edited by Sep 9, 2006, 10:59 PM

        switch($rule['protocol']) {
                                                                                case "tcp/udp":
                                                                                        $protocol = "{ tcp udp }";
                                                                                        $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                        $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                        break;
                                                                                case "tcp":
                                                                                case "udp":
                                                                                        $protocol = $rule['protocol'];
                                                                                        $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                        break;
                                                                                default:
                                                                                        break;
                                                                        }

        **You need to add the case for tcp otherwise tcp get udp case set

        the stream looks good but the local host rule needs the tcp case filled in i tested this and it worked fine
                                                                                case "tcp":
                                                                                        $protocol = $rule['protocol'];
                                                                                        $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                        break**;

        1 Reply Last reply Reply Quote 0
        • S
          sullrich
          last edited by Sep 9, 2006, 11:00 PM

          There is no break, it automatically hits the next case.

          1 Reply Last reply Reply Quote 0
          • A
            aldo
            last edited by Sep 9, 2006, 11:00 PM

            ok sorry i just stripped you code when pasting not mine

            1 Reply Last reply Reply Quote 0
            • A
              aldo
              last edited by Sep 9, 2006, 11:03 PM

              one last thing you have an extra white space on the udp stream now.
              i did them both in clean cases before and all worked well

              for the inetd i added info the the tcp case and the upd case as i did in the localhost allow rule your
              solution was definatly neater but there is a whitespace issue

              1 Reply Last reply Reply Quote 0
              • S
                sullrich
                last edited by Sep 9, 2006, 11:03 PM

                Please test the file that I posted.  It really should be working now.

                1 Reply Last reply Reply Quote 0
                • S
                  sullrich
                  last edited by Sep 9, 2006, 11:03 PM

                  @aldo:

                  one last thing you have an extra white space on the udp stream now.
                  i did them both in clean cases before and all worked well

                  for the inetd i added info the the tcp case and the upd case as i did in the localhost allow rule your
                  solution was definatly neater but there is a whitespace issue

                  Not sure what you mean.  Please show me either the generated rules from rules.debug or the netcat entries from inetd.conf

                  1 Reply Last reply Reply Quote 0
                  • A
                    aldo
                    last edited by Sep 9, 2006, 11:06 PM

                    19000 stream udp nowait/0 nobody /usr/bin/nc nc  -u -w 20 192.168.200.200 161
                    19002 stream tcp nowait/0 nobody /usr/bin/nc nc -w 20 192.168.200.200 8000

                    1 Reply Last reply Reply Quote 0
                    • S
                      sullrich
                      last edited by Sep 9, 2006, 11:08 PM

                      Yeah it doesn't look "good" but it should work..

                      1 Reply Last reply Reply Quote 0
                      • A
                        aldo
                        last edited by Sep 9, 2006, 11:11 PM

                        NAT Reflection rules

                        pass in quick on $lan inet proto udp from any to $loopback port 19000 keep state
                        label "NAT REFLECT: Allow traffic to localhost"
                        pass in quick on $lan inet proto udp from any to $loopback port 19001 keep state
                        label "NAT REFLECT: Allow traffic to localhost"

                        1 Reply Last reply Reply Quote 0
                        • A
                          aldo
                          last edited by Sep 9, 2006, 11:12 PM

                          /* $Id: filter.inc,v 1.575.2.248 2006/09/09 22:53:48 sullrich Exp $ */

                          1 Reply Last reply Reply Quote 0
                          • A
                            aldo
                            last edited by Sep 9, 2006, 11:14 PM

                            this definatly works correctly here

                            switch($rule['protocol']) {
                                                                                                    case "tcp/udp":
                                                                                                            $protocol = "{ tcp udp }";
                                                                                                            $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                            $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                            break;
                                                                                                    case "tcp":
                                                                                                            $protocol = $rule['protocol'];
                                                                                                            $ipfrules .= "pass in quick on ${$ifname_real} inet proto tcp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                            break;
                                                                                                    case "udp":
                                                                                                            $protocol = $rule['protocol'];
                                                                                                            $ipfrules .= "pass in quick on ${$ifname_real} inet proto udp from any to $loopback port {$starting_localhost_port} keep state label "NAT REFLECT: Allow traffic to localhost"\n";
                                                                                                            break;
                                                                                                    default:
                                                                                                            break;
                                                                                            }

                            NAT Reflection rules

                            pass in quick on $lan inet proto udp from any to $loopback port 19000 keep state
                            label "NAT REFLECT: Allow traffic to localhost"
                            pass in quick on $lan inet proto tcp from any to $loopback port 19001 keep state
                            label "NAT REFLECT: Allow traffic to localhost"

                            1 Reply Last reply Reply Quote 0
                            • S
                              sullrich
                              last edited by Sep 9, 2006, 11:17 PM

                              Your not making any sense.  Are you saying what is commited does not work?  There is no difference, the udp case gets hit for tcp OR udp since there is no break.

                              Watch this example program:

                              $protocol = "tcp";

                              switch($protocol) {
                                      case "tcp":
                                      case "udp":
                                              echo "case met";

                              }

                              ?>

                              php -f test.php

                              case met#

                              As you can see since there is no break, the case "udp" gets processed for either.

                              Now consider this:

                              $protocol = "udp";

                              switch($protocol) {
                                      case "tcp":
                                      case "udp":
                                              echo "case met";

                              }

                              ?>

                              php -f test.php

                              case met#

                              As you can see you do not need to do it your way.

                              1 Reply Last reply Reply Quote 0
                              • A
                                aldo
                                last edited by Sep 9, 2006, 11:20 PM

                                i agree but that was the result

                                1 Reply Last reply Reply Quote 0
                                • S
                                  sullrich
                                  last edited by Sep 9, 2006, 11:24 PM

                                  Rerun the commands that I mentioned earlier.  I have updated the file to cover the tcp case either way.

                                  I know for a fact that if other devs catch wind of this they are not going to like it.  I would have to agree with them, this should not be necessary.

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    aldo
                                    last edited by Sep 9, 2006, 11:46 PM

                                    i see the issue scott

                                    make the udp case empty above the tcp case
                                    and fill in the tcp case but then look at your working cases in the rdr sections there is the issue
                                    i reran the commands but there is an error in the filter.inc on 389 or thereabouts now as well i fixed an if that was missing an I

                                    role it back scott i will work on it tomorrow i understand what youa re trying to achieve now and how you should do it using your method.
                                    i will have better resourses tomorrow i am at home at moment and is 1am

                                    i will send you the diffs tomorrow for your review

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      aldo
                                      last edited by Sep 10, 2006, 12:20 AM

                                      ok i think you will be happy with the localhost rules but not so pleased with the nc inetd bits
                                      have a look and let me know

                                      it works perfectly and that was my goal

                                      filter.inc.txt

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        sullrich
                                        last edited by Sep 10, 2006, 12:27 AM

                                        Looks like you started with a dated filter.inc.

                                        Can you:

                                        #1 update your filter.inc and make the changes again
                                        #2 send a diff -u patch?  I need to also make these changes in -HEAD which this will assist with

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          aldo
                                          last edited by Sep 10, 2006, 12:41 AM

                                          will do it tomorrow for you got it working on a 7-9-06 box.

                                          so will diff for you when i can

                                          1 Reply Last reply Reply Quote 0
                                          41 out of 58
                                          • First post
                                            41/58
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received