Project

General

Profile

Actions

Bug #12319

open

IPv6 Port Forwarding rules doesn't work in NAT+Proxy mode

Added by Viktor Gurov about 2 months ago. Updated 14 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
-
Category:
Rules / NAT
Target version:
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Plus-Next
Release Notes:
Default
Affected Version:
2.5.2
Affected Architecture:

Description

Invalid rules created:

# NAT Inbound Redirects
rdr pass on vtnet0 inet proto tcp from any to 192.168.3.4 port 110 -> 192.168.3.42 port 443
rdr on vtnet0 inet6 proto tcp from any to fc00:3::4 port 110 -> fc00:123::5555 port 443
# Reflection redirects
rdr on { vtnet2  enc0 openvpn WireGuard } proto tcp from any to fc00:3::4 port 110 tag PFREFLECT -> 127.0.0.1 port 19000

Aug 31 15:46:53 pf4 php-fpm[1161]: /rc.filter_configure_sync: New alert found: There were error(s) loading the rules:
/tmp/rules.debug:185: no translation address with matching address family found. - The line in question reads [185]:
rdr on { vtnet2  enc0 openvpn WireGuard } proto tcp from any to fc00:3::4 port 110 tag PFREFLECT -> 127.0.0.1 port 19000

/var/etc/xinetd.conf:

service 19000-tcp
{
    type = unlisted
    bind = 127.0.0.1
    port = 19000
    socket_type = stream
    protocol = tcp
    wait = no
    user = nobody
    server = /usr/bin/nc
    server_args = -w 2000 fc00:123::5555 443
}

Actions #1

Updated by Jim Pingle about 2 months ago

I'm not sure we should even try supporting that mode for IPv6, it's bad enough for IPv4.

I'm inclined to have the backend code skip any IPv6 in that mode, and drop a note in the GUI on the reflection options stating that isn't supported for IPv6. Maybe toss an input validation error if someone picks that mode specifically on a port forward with IPv6 addresses.

Actions #3

Updated by Jim Pingle about 2 months ago

  • Status changed from New to Pull Request Review
  • Target version set to CE-Next
  • Plus Target Version set to Plus-Next
Actions #4

Updated by Viktor Gurov 14 days ago

  • Status changed from Pull Request Review to Feedback
  • % Done changed from 0 to 100
Actions

Also available in: Atom PDF