icmp network unreach(able)

--0016363b85c4fcddd3049c242b36
Content-Type: text/plain; charset=ISO-8859-1

We have a large private network (10.0.0.0/8) to which we need to allow
enterprise users access from (172.16.0.0/12) running on netbsd 5.x (ipf
v4.1.29).

The public side nat ip's are 192.168.100.0/24.

/etc/ipnat.conf has various lines mapping ip subnets of the enterprise to
special ips thusly:
map bge0 172.16.0.0/16 -> 192.168.1.4/32 portmap tcp auto
map bge0 172.17.0.0/16 -> 192.168.1.5/32 portmap tcp auto
map bge0 172.18.0.0/16 -> 192.168.1.6/32 portmap tcp auto
map bge0 172.19.0.0/16 -> 192.168.1.7/32 portmap tcp auto
etc.

/etc/ipnat.conf also has internal private network ip's mapped one to one
with 192.168.100.0/24 thusly:
map bge1 10.1.2.3/32 -> 192.168.100.7/32 portmap tcp auto
map bge1 10.1.20.4/32 -> 192.168.100.8/32 portmap tcp auto
map bge1 10.1.2.5/32 -> 192.168.100.9/32 portmap tcp auto
map bge1 10.1.34.88/32 -> 192.168.100.10/32 portmap tcp auto
etc.

/etc/ipf.conf allows ports 12000 thru 12100 thru for all hosts with no port
translation.

My issue is that the nat is not working even though ipmon shows all the
packets passing without issue.  When I snoop on the internal network I see
messages like "ICMP NETWORK UNREACH".  I also see the connection starting on
"netstat -an" output but hung with a state of "SYN_RCVD".

The internal host has the proper route in "netstat -nr" and knows how to
reach 192.168.1.0/24.

So what am I doing wrong?

I hope this is detailed enough to help y'all.

Thanks, Abby

--0016363b85c4fcddd3049c242b36
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<br>We have a large private network (<a href=3D"http://10.0.0.0/8">10.0.0.0=
/8</a>) to which we need to allow enterprise users access from (<a href=3D"=
http://172.16.0.0/12">172.16.0.0/12</a>) running on netbsd 5.x (ipf v4.1.29=
).<br>
<br>The public side nat ip&#39;s are <a href=3D"http://192.168.100.0/24">19=
2.168.100.0/24</a>.=A0 <br><br>/etc/ipnat.conf has various lines mapping ip=
 subnets of the enterprise to special ips thusly:<br>map bge0 <a href=3D"ht=
tp://172.16.0.0/16">172.16.0.0/16</a> -&gt; <a href=3D"http://192.168.1.4/3=
2">192.168.1.4/32</a> portmap tcp auto<br>
map bge0 <a href=3D"http://172.17.0.0/16">172.17.0.0/16</a> -&gt; <a href=
=3D"http://192.168.1.5/32">192.168.1.5/32</a> portmap tcp auto<br>map bge0 =
<a href=3D"http://172.18.0.0/16">172.18.0.0/16</a> -&gt; <a href=3D"http://=
192.168.1.6/32">192.168.1.6/32</a> portmap tcp auto<br>
map bge0 <a href=3D"http://172.19.0.0/16">172.19.0.0/16</a> -&gt; <a href=
=3D"http://192.168.1.7/32">192.168.1.7/32</a> portmap tcp auto<br>
etc.<br><br>/etc/ipnat.conf also has internal private network ip&#39;s mapp=
ed one to one with <a href=3D"http://192.168.100.0/24">192.168.100.0/24</a>=
 thusly:<br>map bge1 <a href=3D"http://10.1.2.3/32">10.1.2.3/32</a> -&gt; <=
a href=3D"http://192.168.100.7/32">192.168.100.7/32</a> portmap tcp auto<br=
>


map bge1 <a href=3D"http://10.1.20.4/32">10.1.20.4/32</a> -&gt; <a href=3D"=
http://192.168.100.8/32">192.168.100.8/32</a> portmap tcp auto<br>


map bge1 <a href=3D"http://10.1.2.5/32">10.1.2.5/32</a> -&gt; <a href=3D"ht=
tp://192.168.100.9/32">192.168.100.9/32</a> portmap tcp auto<br>


map bge1 <a href=3D"http://10.1.34.88/32">10.1.34.88/32</a> -&gt; <a href=
=3D"http://192.168.100.10/32">192.168.100.10/32</a> portmap tcp auto<br>


etc.<br><br>/etc/ipf.conf allows ports 12000 thru 12100 thru for all hosts =
with no port translation.<br><br>My issue is that the nat is not working ev=
en though ipmon shows all the packets passing without issue.=A0 When I snoo=
p on the internal network I see messages like &quot;ICMP NETWORK UNREACH&qu=
ot;.=A0 I also see the connection starting on &quot;netstat -an&quot; outpu=
t but hung with a state of &quot;SYN_RCVD&quot;.<br>
<br>The internal host has the proper route in &quot;netstat -nr&quot; and k=
nows how to reach <a href=3D"http://192.168.1.0/24">192.168.1.0/24</a>.=A0 =
<br><br>So what am I doing wrong?<br><br>I hope this is detailed enough to =
help y&#39;all.<br>
<br>Thanks, Abby<br>

--0016363b85c4fcddd3049c242b36--