Re: pf NAT and VNET Jails

> On 05 Nov 2015, at 17:25, Shawn Webb <shawn.webb_at_hardenedbsd.org> wrote:
> I've figured it out. I've removed all rules and went with a barebones config.
> 
> Right now, the laptop I'm using for NAT has an outbound interface of wlan0
> with an IP of 129.6.251.181 (from DHCP). The following line works:
> 
> nat on wlan0 from any to any -> 129.6.251.181
> 
> The following line doesn't:
> 
> nat on wlan0 from any to any -> (wlan0)
> 
> Nor does this:
> 
> nat on wlan0 from any to any -> wlan0
> 
> From the Handbook, the lines that don't work are prefered especially the first
> non-working line, since using (wlan0) would cause pf to pick up wlan0's IP
> dynamically (which is good, since wlan0 is DHCP'd).
> 
> So it seems at some point of time, doing NAT dynamically broke.
> 

So far I’ve had no luck reproducing this.
With pf.conf:
nat on vtnet0 from any to any -> (vtnet0)
pass in
pass out

And setup code:
ifconfig bridge0 create
ifconfig epair0 create
ifconfig epair0a up
ifconfig epair0b up
ifconfig bridge0 addm epair0a

jail -c name=test host.hostname=test vnet persist
ifconfig epair0b vnet test

ifconfig bridge0 inet 10.0.0.1/24

jexec test ifconfig epair0b 10.0.0.2/23
jexec test route add default 10.0.0.1

# Activate routing
sysctl net.inet.ip.forwarding=1

pfctl -e
pfctl -g -f pf.conf

Then I run exec test ping 8.8.8.8, which works as expected.

My home routing is running CURRENT, used vnet jails and also doesn’t seem to be triggering the problem.

Perhaps we’re still missing a component of the problem, but right now I have no idea what that would be.

Hmm. Perhaps… do you happen to know in what order things are done during startup?
Perhaps it’s related to the fact that wlan0 is both wifi and DHCP, in the sense that pf is configured before the IP is assigned to the interface.

Can you try reloading pf with the (wlan0) rule? (Just pfctl -g -f /etc/pf.conf should do the trick).

Regards,
Kristof