Project

General

Profile

Actions

Todo #15220

closed

Handle ``route-to`` and ``reply-to`` states when using the ``if-bound`` state policy

Added by Marcos M 3 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Category:
Rules / NAT
Target version:
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
24.03
Release Notes:
Force Exclusion

Description

With the re-introduction of if-bound as the default PF state policy, services on the firewall (which do not automatically add a route) bound to secondary WAN's will fail. This is due to route-to outbound states being bound to the route interface (details on #12630).

For rules with reply-to, outbound traffic doesn't match the state - presumably it only looks for the route interface (and not also the route-to interface).

vmx2 tcp 10.0.10.30:8999 (192.168.1.253:8999) <- 198.51.100.227:56295       CLOSED:SYN_SENT
   [0 + 64240]  [3309371906 + 1]
   age 00:00:25, expires in 00:00:12, 4:0 pkts, 240:0 bytes, rule 799
   id: edb4ba6500000000 creatorid: af6c8b55 reply-to: 192.168.1.254@vmx2

@799 pass in quick on vmx2 reply-to (vmx2 192.168.1.254) inet proto tcp from any to <d_TEST:1> port = 8999 flags S/SA keep state (if-bound) label "USER_RULE: NAT TEST" label "id:1679170149" ridentifier 1679170149
  [ Evaluations: 32        Packets: 75        Bytes: 4500        States: 1     ]
  [ Inserted: uid 0 pid 0 State Creations: 19    ]
  [ Last Active Time: Tue Jan 30 12:44:44 2024 ]

This essentially breaks anything that isn't simply a failover-only multi-WAN setup such as an OpenVPN server listening on a second WAN, port forwarding on a second WAN, and accessing the WebGUI on a second WAN.


Related issues

Related to Todo #15173: Add global option to set default PF State Policy (if-bound vs floating)ResolvedJim Pingle

Actions
Related to Feature #855: Ability to selectively kill states on gateway recoveryResolvedMarcos M08/27/2010

Actions
Related to Bug #15363: Reply traffic on a secondary WAN may be dropped when passed through dummynetResolvedKristof Provost

Actions
Actions #1

Updated by Marcos M 3 months ago

  • Status changed from New to In Progress

The route-to issue has been addressed upstream

Actions #2

Updated by Marcos M 3 months ago

  • Related to Todo #15173: Add global option to set default PF State Policy (if-bound vs floating) added
Actions #3

Updated by Marcos M 3 months ago

  • Related to Feature #855: Ability to selectively kill states on gateway recovery added
Actions #4

Updated by Marcos M 3 months ago

  • Related to Bug #12630: States are always created on the default gateway interface. added
Actions #5

Updated by Marcos M 3 months ago

  • Related to Regression #13420: TCP traffic sourced from the firewall can only use the default gateway added
Actions #6

Updated by Marcos M 3 months ago

  • Related to Bug #1342: kernel crash with RC1 on vmware added
Actions #7

Updated by Marcos M 3 months ago

  • Related to deleted (Bug #1342: kernel crash with RC1 on vmware)
Actions #8

Updated by Marcos M 3 months ago

  • Related to deleted (Regression #13420: TCP traffic sourced from the firewall can only use the default gateway)
Actions #9

Updated by Marcos M 3 months ago

  • Related to deleted (Bug #12630: States are always created on the default gateway interface.)
Actions #10

Updated by Marcos M 2 months ago

  • Subject changed from Update state creation and matching for route-to and reply-to when using the if-bound state policy to Handle route-to and reply-to states when using the if-bound state policy
  • Description updated (diff)
Actions #11

Updated by Marcos M 2 months ago

  • Status changed from In Progress to Pull Request Review

It seems the reply-to issue can only really be handled by using floating on the rule. This can be done on rule generation, or in PF itself:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/1134

Actions #12

Updated by Kristof Provost about 2 months ago

  • Status changed from Pull Request Review to Feedback

I've merged a pf change that fixed reply-to with if-bound states. It should mean that the above merge request is no longer required.

Actions #13

Updated by Marcos M about 2 months ago

  • Status changed from Feedback to Resolved

I cannot reproduce the issue with the fix in place.

Actions #14

Updated by Marcos M about 2 months ago

  • % Done changed from 0 to 100
Actions #15

Updated by Jim Pingle about 1 month ago

  • Subject changed from Handle route-to and reply-to states when using the if-bound state policy to Handle ``route-to`` and ``reply-to`` states when using the ``if-bound`` state policy
  • Release Notes changed from Default to Force Exclusion
Actions #16

Updated by Marcos M 26 days ago

  • Related to Bug #15363: Reply traffic on a secondary WAN may be dropped when passed through dummynet added
Actions

Also available in: Atom PDF