Project

General

Profile

Bug #2121

Todo #2109: pfSense on FreeBSD 10.x

pfctl -ss output has changed on FreeBSD 10

Added by Jim Pingle over 6 years ago. Updated about 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Web Interface
Target version:
Start date:
01/20/2012
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.2
Affected Architecture:

Description

The state parsing code in diag_dump_states.php and elsewhere needs updated since on FreeBSD 9.x the format of the state output has changed.

For example, previously a NAT state looked like so:

all tcp internalip:64123 -> externalip:39329 -> destinationip:80    ESTABLISHED:ESTABLISHED

And now it looks like:

all tcp externalip:37706 (internalip:1051) -> destinaionip:80       ESTABLISHED:ESTABLISHED

diag_dump_states.png (9.59 KB) diag_dump_states.png Thiago Basilio, 09/22/2014 09:13 AM

Associated revisions

Revision 5344099a (diff)
Added by Jim Pingle over 4 years ago

Various fixes to diag_dump_states.php (Add interface column, some extra validation safety, etc). Should fix #2121

Revision c245a846 (diff)
Added by Jim Pingle about 4 years ago

Adjust states summary for new pfctl -ss output. Fixes #2121

History

#1 Updated by Seth Mos over 6 years ago

maybe fixup on the state print patches so that the -> is added back?

#2 Updated by Jim Pingle over 6 years ago

I think I prefer the new output, it's a clearer separation for which is the internal IP rather than guess by counting ->'s

Probably need some more output examples though (say, from 1:1 NAT and port forwards) to really say how hard it might be to adjust.

#3 Updated by Erik Fonnesbeck over 6 years ago

Looks like the format for the changed part is like this:

NAT on destination (port forward)
destination_after_nat (destination_before_nat) <- source

NAT on source (outbound NAT)
source_after_nat (source_before_nat) -> destination

#4 Updated by Jim Pingle over 6 years ago

  • Parent task set to #2109

#5 Updated by Jim Pingle over 6 years ago

  • Target version changed from 2.1 to 2.2

#6 Updated by Chris Buechler over 6 years ago

  • Affected Version changed from 2.1 to 2.2

#7 Updated by Renato Botelho almost 5 years ago

  • Subject changed from pfctl -ss output has changed on FreeBSD 9 to pfctl -ss output has changed on FreeBSD 10

#8 Updated by Jim Pingle almost 5 years ago

The format is slightly different on 10.x than 9.x examples above.
In this sample output, 192.0.2.x is WAN on em0, 192.168.94.x is LAN on em1

em0 icmp 192.0.2.89:32114 -> 192.0.2.1:32114       0:0
em0 icmp 192.0.2.89:44428 (192.168.94.1:26879) -> 74.125.225.114:44428       0:0
lo0 udp 127.0.0.1:43924 -> 127.0.0.1:53       MULTIPLE:SINGLE
em0 tcp 192.168.94.99:999 (192.0.2.89:999) <- 192.0.2.31:59269       CLOSED:SYN_SENT
em1 tcp 192.0.2.31:59269 -> 192.168.94.99:999       SYN_SENT:CLOSED

The first column for the interface should probably be parsed and printed on the page now that it is meaningful.

#9 Updated by Jim Pingle over 4 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

#10 Updated by Jim Thompson about 4 years ago

  • Assignee set to Jim Pingle

#11 Updated by Jim Pingle about 4 years ago

  • Status changed from Feedback to New

Moving this back to New. The states table display is OK now but diag_states_summary.php breaks with the new formatting.

#12 Updated by Jim Pingle about 4 years ago

  • Status changed from New to Feedback

#13 Updated by Thiago Basilio about 4 years ago

Latest snapshot seems OK.

(pfctl -ss output)

$ pfctl -ss
re1 tcp 192.168.228.18:8530 <- 192.168.1.100:1049       ESTABLISHED:ESTABLISHED
re0 icmp 192.168.228.107:6213 -> 192.168.228.1:6213       0:0
lo0 ipv6-icmp ff02::1[16448] <- fe80::1:1[16448]       NO_TRAFFIC:NO_TRAFFIC
re1 ipv6-icmp fe80::1:1[16448] -> ff02::1[16448]       NO_TRAFFIC:NO_TRAFFIC
re1 tcp 192.168.1.1:443 <- 192.168.1.100:1195       ESTABLISHED:ESTABLISHED
re0 tcp 192.168.228.107:46232 -> 208.123.73.83:443       FIN_WAIT_2:FIN_WAIT_2

For diag_dump_states.php output, there is a image attached.

..
pfSense 2.2-BETA amd64
Firefox ESR 24.8.0 win32
..

#14 Updated by Jim Pingle about 4 years ago

  • Status changed from Feedback to Resolved

Also available in: Atom PDF