Hi Justin, Not sure if you still need to use divert-packet with NAT, but if you do, could you please try the diff at http://marc.info/?l=openbsd-tech&m=136245826921904&w=2 to see if it works for you?
The easiest way to get the diff is: ftp -o divert-checksum.diff \ 'http://marc.info/?l=openbsd-tech&m=136245826921904&q=raw' If you do try it, please let me know if it works for you. Thanks, Lawrence On Wed, Dec 19, 2012 at 03:09:47PM -0600, Justin Mayes wrote: > Another update in case there is any interest in running divert-packet along > with NATing. I ditched snort and wrote a little divert program based on the > man page to test easier. I can now see that with nat as well as > divert-packet on egress rule on external interface the packet will get > NATed and go out. A reply will come back to external interface and then get > diverted again and never make it to the client. I am as sure as I can be at > this point that you cannot divert packets from a NATed client. > > Justin > > -----Original Message----- > From: owner-m...@openbsd.org [mailto:owner-m...@openbsd.org] On Behalf Of > Justin > Sent: Sunday, November 25, 2012 4:37 PM > To: misc@openbsd.org > Subject: Re: snort inline > > Quick update. It seems to be a nat problem. If I just test by pinging either > the 192.168.1.32 interface or the 192.168.0.13 interface it works fine and > snort sees the packets. Its only when the traffic is NATed that it fails. > > > > -----Original Message----- > From: owner-m...@openbsd.org [mailto:owner-m...@openbsd.org] On Behalf Of > Justin > Sent: Saturday, November 24, 2012 2:21 PM > To: misc@openbsd.org > Subject: snort inline > > Anyone running snort 2.9.3.1p0 in inline / IPS mode with 5.2 cuurent? From > what I read it's possible with pf divert functionality. > > This is what I'm doing for testing in pf using simple ping > > > > Gateway info > > internal interface fxp0 - 192.168.1.32 > > external interface bce0 - 192.168.0.13 > > > > Running snort via this cmd line > > snort --daq-dir /usr/local/lib/daq -Q --daq ipfw -c /etc/snort/snort.conf -v > > > > Internal interface is in the skip list hence no active rules for it > > Pfctl -sr > > pass out on bce0 all flags S/SA scrub (reassemble tcp) nat-to (bce0:0) > > pass in on bce0 inet all flags S/SA scrub (reassemble tcp) > > > > This works as expected, I can ping 8.8.8.8 and since no diverting is active > snort sees nothing > > I change rules to this to start diverting to snort > > Pfctl -sr > > pass out on bce0 all flags S/SA scrub (reassemble tcp) divert-packet port > 8000 nat-to (bce0:0) > > pass in on bce0 inet all flags S/SA scrub (reassemble tcp) > > > > Now internal interface sees outgoing ping > > tcpdump -n -i fxp0 -n host 8.8.8.8 > > 192.168.1.32 > 8.8.8.8: icmp: request: > > > > External interface shows it going out and coming back > > 192.168.0.13 > 8.8.8.8: icmp: request: > > 8.8.8.8 > 192.168.0.13: icmp: reply: > > > > Snort sees it twice, external interface first > > 192.168.0.13 -> 8.8.8.8 > > ICMP TTL:63 TOS:0x0 ID:0 IpLen:20 DgmLen:84 DF > > Type:8 Code:0 ID:64870 Seq:2 ECHO > > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ > > > > 8.8.8.8 -> 192.168.1.32 > > ICMP TTL:48 TOS:0x20 ID:64655 IpLen:20 DgmLen:84 > > Type:0 Code:0 ID:52297 Seq:2 ECHO REPLY > > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ > > > > Client @ 192.168.1.32 never sees reply. Any comments or suggestions? > > > > Justin