I hope somebody here can help me with a PF/NAT problem I'm having. I'm moving a machine of ours from OpenBSD 2.9 to 3.2. This was all working with IPF running on the 2.9 install.
The machine in question ("nat") is working as a front for a DNS(SEC) server. It takes UDP or TCP packets to port 53 on its external interface (xl0) and forwards them out its internal interface (xl1) to the real server running on a different. The machine the real server is running on ("dennis") is further back in our network, behind a few firewalls and in private IP space. Finally, nat is not along the default path of dennis. Because of this, the source address of the redirected packets needs to be rewritten to nat's internal IP address. One side note about this. Normal DNS (UDP) queries do not fragment, but it's not unusual to see DNSSEC queries fragment. This is the whole reason we set up nat in the first place. The older BigIP boxes we were using were dropping the UDP fragments returned by dennis. Non-DNSSEC queries would work and TCP-based DNSSEC queries would work, but the UDP-based DNSSEC queries would fail. With OpenBSD 2.9, I was able to get this set up working without any problems using the following: ==================== rdr xl0 PP.PP.PP.PP/32 port 53 -> DD.DD.DD.DD port 5353 tcp/udp map xl1 from 0.0.0.0/0 to DD.DD.DD.DD port = 5353 -> II.II.II.II/32 portmap tcp/udp 10000:65000 ==================== Where PP.PP.PP.PP == nat's Public IP II.II.II.II == nat's Internal IP DD.DD.DD.DD == dennis' IP With OpenBSD 3.2, I'm back to the same problem I was having with the BigIPs. It looks like nat's dropping the UDP fragments returned from dennis. This is the first time I've used pf, so I'm fairly certain that it's just a problem with configuration of pf. I'm hoping someone can help me. This is the entire pf.conf file I'm using: ==================== ExtIf="xl0" IntIf="xl1" DNS="PP.PP.PP.PP" Dennis="DD.DD.DD.DD" #scrub in all scrub in on $ExtIf all fragment reassemble scrub in on $IntIf all fragment reassemble rdr on $ExtIf proto {udp,tcp} from any to $DNS port 53 -> $Dennis port 5353 nat on $IntIf proto {udp,tcp} from any to $Dennis port 5353 -> $IntIf pass in all pass out all ==================== I tried the commented out "scrub in all" vs the other two "scrub" commands, but that didn't help. With this configuration loaded, normal UDP queries to PP.PP.PP.PP work fine. TCP-based DNSSEC queries also work fine. The UDP-based DNSSEC queris are failing. From tcpdumps on nat's two interfaces and on dennis' interface, here's the patch I stitched together... (dennis' time is off slightly.) ===== DNSSEC query comes into nat's external interface 14:33:26.917445 XX.XX.XX.XX.43263 > PP.PP.PP.PP.53: 18333+ [1au] A? foo.com. (36) (DF) ===== Nat RDRs it to dennis (DD.DD.DD.DD) and NATs it to its internal interface (II.II.II.II) 14:33:26.917596 II.II.II.II.56175 > DD.DD.DD.DD.5353: udp 36 (DF) ===== Dennis receives the query... 14:33:26.752437 II.II.II.II.56175 > DD.DD.DD.DD.5353: udp 36 (DF) ===== ...and replies to it. This is where the frag begins. 14:33:26.784417 DD.DD.DD.DD > II.II.II.II: (frag 55914:[EMAIL PROTECTED]) 14:33:26.784437 DD.DD.DD.DD.5353 > II.II.II.II.56175: udp 1643 (frag 55914:[EMAIL PROTECTED]) ===== Nat receives the two reply fragments 14:33:26.951181 DD.DD.DD.DD.5353 > II.II.II.II.56175: udp 1643 (frag 55914:[EMAIL PROTECTED]) 14:33:26.951195 DD.DD.DD.DD > II.II.II.II: (frag 55914:[EMAIL PROTECTED]) ===== Nothing goes out Nat's external interface Anybody have any ideas? Am I using scrub incorrectly? Should I be using scrub? Is there something else I'm doing wrong? Is there any other potentially useful information I forgot to give? BTW, this machine is running -STABLE, patched up to Wednesday night. Thanks, pete