Fwd: ipfilter 4.1.34 rdr on solaris 10

--20cf300fafc991925504ad9f66db
Content-Type: text/plain; charset=ISO-8859-1

Recently upgrade solaris sparc from 8 to 10, there is ipfilter on the
servers.
it seems rdr simply does not work properly on solaris 10.
given an example ipnat rdr rule:

rdr eri0 0.0.0.0/0 port 16398 -> 172.25.128.236 port 12000 udp

Use snoop to monitor the packets.
On solais 8, the rdr rule works fine and have the redirected udp packets
sending out. (with dest ip/port changed to 172.25.128.236/12000)
However, on solaris 10, there is NO redirected packets sending out.

Both solaris 8 and 10 run the same ipfilter 4.1.34 with same config.
Both solaris 8 and 10 have single ethernet interface.
Solaris 10 is 5/09 u7 sparc versioin.

# ipf -V
ipf: IP Filter: v4.1.34 (720)
Kernel: IP Filter: v4.1.34
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 0
Feature mask: 0x187

In addition, on solaris 10, use dtrace to monitor ipfilter function call
flow, found the incoming UDP packet with port 16398 captured by
ipfilter fr_check(), and the dest ip/port also changed to
172.25.128.236/12000 after fr_checknatin() gets called.

p.s. The solaris 10 stock ipf 4.1.9 meets the same issue as ipfilter 4.1.34.

Please, who can give a hand?

Regards,
James Huang

--20cf300fafc991925504ad9f66db
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">Recently upgrade solaris sparc from 8 to 10, the=
re is ipfilter=A0on the servers.<div>it seems rdr simply does not work prop=
erly on solaris 10.</div><div>given an example ipnat rdr rule:</div><div><b=
r>

</div><div>rdr eri0 <a href=3D"http://0.0.0.0/0" target=3D"_blank">0.0.0.0/=
0</a> port 16398 -&gt; 172.25.128.236 port 12000 udp</div>
<div><br></div><div>Use snoop to monitor the packets.</div><div>On solais 8=
, the rdr rule works fine and have the redirected udp packets sending out. =
(with dest ip/port changed to <a href=3D"http://172.25.128.236/12000" targe=
t=3D"_blank">172.25.128.236/12000</a>)</div>


<div>However, on solaris 10, there is NO redirected packets sending out.</d=
iv><div><br></div><div>Both solaris 8 and 10 run the same ipfilter 4.1.34 w=
ith same config.</div><div>Both solaris 8 and 10 have single ethernet inter=
face.</div>


<div>Solaris 10 is 5/09 u7 sparc versioin.</div><div><br></div><div><div># =
ipf -V</div><div>ipf: IP Filter: v4.1.34 (720)</div><div>Kernel: IP Filter:=
 v4.1.34</div><div>Running: yes</div><div>Log Flags: 0 =3D none set</div>


<div>Default: pass all, Logging: available</div><div>Active list: 0</div><d=
iv>Feature mask: 0x187</div></div><div><br></div><div>In addition, on solar=
is 10, use dtrace to monitor ipfilter function call flow, found the incomin=
g UDP packet with port 16398 captured by</div>


<div>ipfilter fr_check(), and the dest ip/port also changed to=A0<a href=3D=
"http://172.25.128.236/12000" target=3D"_blank">172.25.128.236/12000</a> af=
ter=A0fr_checknatin() gets called.</div><div><br></div><div>p.s. The solari=
s 10 stock ipf 4.1.9 meets the same issue as ipfilter 4.1.34.</div>


<div><br></div><div>Please, who can give a hand?<br clear=3D"all"><br>Regar=
ds,<br><font color=3D"#888888">James Huang<br>
</font></div>
</div><br>

--20cf300fafc991925504ad9f66db--