Hi misc,
I've been trying to do NAT64 across different rdomains, but haven't had
any success so far. My test setup is as follows:
+-----------------------+
| client |
| . . . . . . . . . . . |
| fd00::2/112 |
+-----------+-----------+
|
Ethernet |
|
+-----------+-----------+
| OpenBSD router |
| . . . . . . . . . . . |
| rdomain 0 |
| re0: fd00::1/112 |
| lo0: ::1/128 |
| . . . . . . . . . . . |
| rdomain 1 |
| lo1: 127.0.0.1/8 |
+-----------------------+
There is a "service" running on the OpenBSD router in rdomain 1,
listening to 127.0.0.1 port 1234:
nc -V 1 -vl 127.0.0.1 1234
The client tries to connect the service via:
nc -zv 64:ff9b::7f00:1 1234
pf.conf only contains the following one line:
pass in log on re0 inet6 proto {tcp, udp} \
from (re0:network) to 64:ff9b::/96 \
rtable 1 af-to inet from 127.0.0.1
packet forwarding is enabled :
net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1
In my imagination, the client should be able to reach the service and
get a response, with the NAT64ed packet translated to a packet of
127.0.0.1 -> 127.0.0.1. However, although the incoming packet shows up
on pflog0 (so it does match the pf rule), it is not detected on the side
of the listening nc.
Any insights into why this setup does not work, or is "rtable"
incompatible with "af-to"?
Thanks!