Project

General

Profile

Bug #3331

Rules to pass out traffic for Proxy ARP VIP entries have an incorrect destination

Added by Jim Pingle over 5 years ago. Updated over 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Rules/NAT
Target version:
Start date:
11/19/2013
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.1
Affected Architecture:

Description

On 2.1 some rules are generated on an interface (e.g. WAN) to pass out traffic for Proxy ARP VIP addresses. These rules look like so:

pass out route-to ( em0 [gateway_ip] ) from [parp_vip] to ![parp_vip]/32 keep state allow-opts label "let out anything from firewall host itself" 

However the destination for that rule should not be "![parp_vip]/32" but "![interface_subnet_id]/[interface_subnet_mask]"

For example:

pass out route-to ( em0 192.0.2.1 ) from 192.0.2.55 to !192.0.2.0/24 keep state allow-opts label "let out anything from firewall host itself" 

As a consequence of this, traffic from a 1:1 NAT host using one of these VIPs is unable to reach items in the WAN subnet depending on how the gateway handles the packets, since the packets are directed at the gateway rather than sent directly. The case is less clear if the VIP lies outside of a subnet that exists on the firewall.

A similar issue is possible with IP Alias VIPs but with IP Alias VIPs the subnet mask on the VIP can be changed to match the interface, negating the issue.

As a temporary workaround, a floating rule can be added on WAN to pass quick out to the WAN subnet.

Associated revisions

Revision d3b17c9a (diff)
Added by Renato Botelho over 5 years ago

Fix #3331. Set interface subnet as destination when VIP is in the same subnet, otherwise use VIP subnet instead of IP address

Revision 82d1a33e (diff)
Added by Renato Botelho over 5 years ago

Fix #3331. Set interface subnet as destination when VIP is in the same subnet, otherwise use VIP subnet instead of IP address

History

#1 Updated by Renato Botelho over 5 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

#3 Updated by Chris Buechler over 5 years ago

  • Status changed from Feedback to Resolved

Also available in: Atom PDF