Very Computer

by **Marc Bigle** » Thu, 10 May 2001 05:05:01

Hello,

I am using IPNAT to let some workstations on a private network access
the internet thru my internet network. Basically my firewall runs on
OpenBSD and has 2 network cards. 1 for the private network and one for
my network which is connected to internet thru my DSL router.

My problem is that when I try to do a traceroute to any machines on the
net (traceroute www.openbsd.org for example) from one of my computers on
my private network the traceroute only shows the IP address of my
firewall and then continues the next lines with stars so I cannot see
the route the packet takes. If I do exactly the same traceroute from my
firewall it works perfectly. I really don't understand whats the
problem. Here is my ipnat.rules:

map ep0 192.168.200.0/24 -> ep0/32 portmap tcp/udp 40000:60000
map ep0 192.168.200.0/24 -> ep0/32

ep0 is my network card connected to the internet network. My ipf.rules
is the same as standard I don't do any filtering so it's the contents
are the default one:

pass in from any to any
pass out from any to any

Thanks in advance for the help btw: the rest works fine it's only the
traceroute which gets blocked.

Regards,
Marc

by **pe..** » Thu, 10 May 2001 05:32:23

> Hello,
> I am using IPNAT to let some workstations on a private network access
> the internet thru my internet network. Basically my firewall runs on
> OpenBSD and has 2 network cards. 1 for the private network and one for
> my network which is connected to internet thru my DSL router.
> My problem is that when I try to do a traceroute to any machines on the
> net (traceroute www.openbsd.org for example) from one of my computers on
> my private network the traceroute only shows the IP address of my
> firewall and then continues the next lines with stars so I cannot see
> the route the packet takes. If I do exactly the same traceroute from my
> firewall it works perfectly. I really don't understand whats the
> problem. Here is my ipnat.rules:
> map ep0 192.168.200.0/24 -> ep0/32 portmap tcp/udp 40000:60000
> map ep0 192.168.200.0/24 -> ep0/32
> ep0 is my network card connected to the internet network. My ipf.rules
> is the same as standard I don't do any filtering so it's the contents
> are the default one:

You could use a 'keep state' rule like :
pass out on rl0 proto icmp from 62.20.110.192/26 to any keep state

where 62.20.110.192/26 is my network and rl0 is my outgoing interface.

Quote:> pass in from any to any
> pass out from any to any
> Thanks in advance for the help btw: the rest works fine it's only the
> traceroute which gets blocked.
> Regards,
> Marc

--
Peter H?kanson
IPSec Sverige (At the Riverside of Gothenburg, home of Volvo)
Sorry about my e-mail address, but i'm trying to keep spam out.
Remove "icke-reklam"and "invalid" and it works.

by **Marc Bigle** » Thu, 10 May 2001 13:17:43

> You could use a 'keep state' rule like :
> pass out on rl0 proto icmp from 62.20.110.192/26 to any keep state

> where 62.20.110.192/26 is my network and rl0 is my outgoing interface.

Thanks for your answer but what I don't understand is that I have already

pass in from any to any
pass out from any to any

That means I do not filter anything, I accept everything to flow between the
two cards, so why do I need to add this extra line ?

Regards
Marc

by **pe..** » Thu, 10 May 2001 16:48:31

>> You could use a 'keep state' rule like :
>> pass out on rl0 proto icmp from 62.20.110.192/26 to any keep state

>> where 62.20.110.192/26 is my network and rl0 is my outgoing interface.
> Thanks for your answer but what I don't understand is that I have already
> pass in from any to any
> pass out from any to any

Marc,

i missed that. Sorry. Yes, you are right.

Quote:> That means I do not filter anything, I accept everything to flow between the
> two cards, so why do I need to add this extra line ?

the problem is in the following events :

1- UDP packet outbound ( traceroute sends normal udp packets the only thing is
a low TTL, but it's large enough to be forwarded bt the NAT unit)
2- a router "out there" finds that the TTL is too small for forwarding, it discards
the packets and sends a "icmp time exceeded" to the sender. Included in this
packet is the initial ip and udp portion.
3- this icmp packet is received by tha NAT unit. It's address to him ( cause thats
was in the source-ip after NAT) but some version if ipfilter seems to have problems.
See "http://www.false.net/ipfilter/2000_08/0331.html" for one such problem.

Quote:> Regards
> Marc

--
Peter H?kanson
IPSec Sverige (At the Riverside of Gothenburg, home of Volvo)
Sorry about my e-mail address, but i'm trying to keep spam out.
Remove "icke-reklam"and "invalid" and it works.

by **Dave Uhrin** » Fri, 11 May 2001 12:31:38

> Hello,

> I am using IPNAT to let some workstations on a private network access
> the internet thru my internet network. Basically my firewall runs on
> OpenBSD and has 2 network cards. 1 for the private network and one for
> my network which is connected to internet thru my DSL router.

> My problem is that when I try to do a traceroute to any machines on the
> net (traceroute www.openbsd.org for example) from one of my computers on
> my private network the traceroute only shows the IP address of my
> firewall and then continues the next lines with stars so I cannot see
> the route the packet takes. If I do exactly the same traceroute from my
> firewall it works perfectly. I really don't understand whats the
> problem. Here is my ipnat.rules:

> map ep0 192.168.200.0/24 -> ep0/32 portmap tcp/udp 40000:60000
> map ep0 192.168.200.0/24 -> ep0/32

> ep0 is my network card connected to the internet network. My ipf.rules
> is the same as standard I don't do any filtering so it's the contents
> are the default one:

> pass in from any to any
> pass out from any to any

> Thanks in advance for the help btw: the rest works fine it's only the
> traceroute which gets blocked.

> Regards,
> Marc

If you are running OpenBSD-2.8 and ipfilter is even started, regardless of
the ruleset, return ICMP will be blocked. Windoze boxes use ICMP for
traceroute, not UDP.

Upgrade to OpenBSD-2.9 or downgrade to OpenBSD-2.7 and apply all patches.

by **Marc Bigle** » Fri, 11 May 2001 15:15:58

Quote:> If you are running OpenBSD-2.8 and ipfilter is even started, regardless of
> the ruleset, return ICMP will be blocked. Windoze boxes use ICMP for
> traceroute, not UDP.

> Upgrade to OpenBSD-2.9 or downgrade to OpenBSD-2.7 and apply all patches.

Hi ! Yes I am running version OpenBSD-2.8, I think I will upgrade or either
submit this problem as a bug to OpenBSD and hope they will come out with a
patch similar as the one that Peter H?kanson found
(http://www.false.net/ipfilter/2000_08/0331.html). Thanks Peter btw.

Regards
Marc

Very Computer

IPNAT and ICMP (traceroute)

IPNAT and ICMP (traceroute)

IPNAT and ICMP (traceroute)

IPNAT and ICMP (traceroute)

IPNAT and ICMP (traceroute)

IPNAT and ICMP (traceroute)

IPNAT and ICMP (traceroute)