Problem sa OpenBSD rutiranjem, paketi nestaju

[ indy @ 22.02.2010. 12:21 ] @

Pozdrav,

danas sam naleteo na jako cudan problem sa pf-om. Na poslu koristim Soekris (sa 4 NICa) i OpenBSD 4.4 kao firewall. Imamo 3 podmreze:
lokalna mreza - 10.0.10.0/24
dmz - 10.0.11.0/24
IP tel - 10.0.88.0/24

Danas sam dodao ovu poslednju na vr3 interfejs, i poceli su da nastaju problemi - ne mogu da pingujem nijednu masinu u IP tel podmrezi sa bilo koje druge mreze, niti da uspostavim bilo kakvu konekciju. pf sam prebacio u pass all mode, da pusta sav saobracaj, i ono sto primecujem je sledece:
- sa 10.0.10.15 (A) pingujem 10.0.88.220 (B)
- saobracaj prolazi do B, i B odgovara
- tcpdump na vr3 pokazuje da OpenBSD masina prima pakete od B, nazad ka A
- tcpdump na vr0 (gde je A) ne pokazuje pakete od B

Rutiranje je ispravno podeseno, sve rute ukazuju na prave interfejse.

Ne znam sta jos mogu da pogledam? Da li je neko naleteo na slican problem?

[ igor.vitorac @ 22.02.2010. 21:57 ] @

Daj:
-sliku
-pf.conf
-routing tabelu na openbsd-u

[ indy @ 23.02.2010. 20:26 ] @

Ok, evo slike



[10.0.10.15]---(10.0.10.0/24)-[vr0: 10.0.10.1]-+-------------+

                                               | OpenBSD 4.4 | 

                10.0.11.0/24 -[vr2: 10.0.11.1]-+             +-[vr1: 77.x.y.z]-- ADSL-- (internet) 

                                               |             |

[10.0.88.220]--(10.0.88.0/24)-[vr3: 10.0.88.1]-+------+------+

                                      |

                  10.0.7.1/32-[tun0]--+

Ovo je pf.conf koji sam koristio za test:

Code:

#global

#interfaces
intif="vr0"
extif="vr1"
dmzif="vr2"
phoneif="vr3"
lo0if="lo0"

intip="10.0.10.1/32"
extip="77.x.y.z/32"
dmzip="10.0.11.1/32"
phoneip="10.0.88.1/32"
lo0ip="127.0.0.1/32"

filesrvip="10.0.10.15/32"

tunif="tun0"
table <extip> { $extip }

icmp_types="{ echorep, echoreq, unreach, squench, timex, paramprob }"

# external interface
table <dns_isp> { 62.2.17.60/32, 62.2.24.152/32 }
#table <mail_isp> { }
table <ntpserver> { 192.53.103.0/24, 131.188.3.0/24 }
table <extfax> { 204.11.168.0/21 }

# internal interface
table <localnet> { 10.0.10.0/24 }
table <phonenet> { 10.0.88.0/24 }
table <mobilenet> { 10.0.7.0/24 }

# dmz interface
table <dmznet> { 10.0.11.0/24}

# scrub
scrub all

# nat
nat on $extif from <localnet> -> $extip
#nat on $extif from <phonenet> -> $extip
nat on $extif from <dmznet> -> $extip

# for bufferoverflow
block in  inet6
block out inet6

# default policy
pass in quick  log on $extif
pass out quick log on $extif
pass in quick log on $intif
pass out quick log on $intif
pass in quick log on $dmzif
pass out quick log on $dmzif
pass in quick log on $phoneif
pass out quick log on $phoneif
pass in quick on $tunif
pass out quick on $tunif
pass in quick  on $lo0if
pass out quick on $lo0if

Konacno, ruting tabela (netstat -rn):

Code:

Routing tables

Internet:
Destination        Gateway            Flags   Refs      Use   Mtu  Prio Iface
default            77.x.y.z       UGS        2  1611740     -    48 vr1
10.0.7/24          10.0.7.2           UGS        0    46209     -    48 tun0
10.0.7.2           10.0.7.1           UH         1        0     -    48 tun0
10.0.10/24         link#1             UC        10        0     -    48 vr0
10.0.10.1          00:00:24:cb:1d:4c  UHLc       0      188     -    48 lo0
10.0.10.12         00:23:54:2f:8b:b7  UHLc       0   362483     -    48 vr0
10.0.10.15         00:22:19:cb:e2:60  UHLc       0   161399     -    48 vr0
10.0.10.21         00:80:87:5b:06:fd  UHLc       0        1     -    48 vr0
10.0.10.52         00:23:54:40:3f:8c  UHLc       0     6926     -    48 vr0
10.0.10.101        00:21:9b:32:98:7b  UHLc       1    37152     -    48 vr0
10.0.10.111        00:21:9b:45:74:ec  UHLc       0    59694     -    48 vr0
10.0.10.112        00:21:9b:32:98:3c  UHLc       0   174699     -    48 vr0
10.0.10.113        00:24:81:f7:48:45  UHLc       0   625291     -    48 vr0
10.0.10.131        00:01:02:e3:ba:78  UHLc       3    18211     -    48 vr0
10.0.11/24         link#3             UC         2        0     -    48 vr2
10.0.11.13         00:22:19:51:40:e7  UHLc       1   483021     -    48 vr2
10.0.11.14         00:1e:c9:bb:57:74  UHLc       0    95170     -    48 vr2
10.0.88/24         link#4             UC         1        0     -    48 vr3
10.0.88.220        00:0e:0c:4c:34:27  UHLc       1       68     -    48 vr3
77.x.y.u/29    link#2             UC         1        0     -    48 vr1
77.x.y.z       00:14:7f:e7:cb:28  UHLc       1        0     -    48 vr1
127/8              127.0.0.1          UGRS       0        0 33204    48 lo0
127.0.0.1          127.0.0.1          UH         1        2 33204    48 lo0
224/4              127.0.0.1          URS        0        0 33204    48 lo0

E, sad… Ono sto vidim je da kad uradim ping sa 10.0.10.15, na vr3 se pojavi ping reply od 10.0.88.220, ali taj reply nikad ne stigne do 10.0.10.15, jer se ne pojavljuje na vr0 interfejsu.

Kad pingujem sa 10.0.10.15 na 10.0.88.1, dobijam odgovor. Kad pingujem sa 10.0.88.220 racunar 10.0.10.15, ne dobijam nista. Kad pingujem 10.0.10.1 sa 10.0.88.220, takodje nema nikakvog odgovora.

[ igor.vitorac @ 24.02.2010. 21:34 ] @

Ako malo bolje pogledas ruting tabelu videces da imas red:
10.0.10.1 00:00:24:cb:1d:4c UHLc 0 188 - 48 lo0

Mislim da je to problem.
10.0.10.1 na lo0 interface-u?

Proveri jos jednom da li si dobro copy/paste-ovao.

1. Daj jos:
-ifconfig za sve interface-e

2. Proveri maske i def. gateway-e na client-ima (na svakom LAN-u).

[ indy @ 24.02.2010. 23:10 ] @

E, hvala! To nisam ni video…

Nije greska u kopiranju, zaista je tako. I kako god da obrisem rutu, ona se vraca, uvek sa lo0.

Ovo je sta mi ifconfig daje:

Code:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33204
        groups: lo
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:00:24:cb:1d:4c
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 10.0.10.1 netmask 0xffffff00 broadcast 10.0.10.255
        inet6 fe80::200:24ff:fecb:1d4c%vr0 prefixlen 64 scopeid 0x1
vr1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:00:24:cb:1d:4d
        groups: egress
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 77.x.y.z netmask 0xfffffff8 broadcast 77.x.y.u
        inet6 fe80::200:24ff:fecb:1d4d%vr1 prefixlen 64 scopeid 0x2
vr2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:00:24:cb:1d:4e
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 10.0.11.1 netmask 0xffffff00 broadcast 10.0.11.255
        inet6 fe80::200:24ff:fecb:1d4e%vr2 prefixlen 64 scopeid 0x3
vr3: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:00:24:cb:1d:4f
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 10.0.88.1 netmask 0xffffff00 broadcast 10.0.88.255
        inet6 fe80::200:24ff:fecb:1d4f%vr3 prefixlen 64 scopeid 0x4
enc0: flags=0<> mtu 1536
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33204
        groups: pflog
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
        groups: tun
        inet 10.0.7.1 --> 10.0.7.2 netmask 0xffffffff

[ igor.vitorac @ 25.02.2010. 00:25 ] @

Samo da rascistimo jednu stvar, a to je: da li ima rutiranja izmedju 10.0.10.0/24 i 10.0.11.0/24 ? Tj. da li prolazi ping izmedju ove dve mreze? Za ping nemoj da koristis IP adresu nekog interface-a openbsd-a.

Da li si proverio mask i def. gatew. na uredjajima na 10.0.88.0/24 mrezi ?

[ indy @ 25.02.2010. 08:01 ] @

Da, ping prolazi u oba pravca na 10.0.10.0/24 i 10.0.11.0/24.

10.0.88.220 je jedina masina na tom sabnetu, ostalo su telefoni, koji dobijaju adresu od dhcp-a .88.220. Adresa ima netmask 255.255.255.0.

Code:

eth1      Link encap:Ethernet  HWaddr 00:0E:0C:4C:34:27
          inet addr:10.0.88.220  Bcast:10.0.88.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3203443 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3209238 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:727882525 (694.1 MiB)  TX bytes:740383695 (706.0 MiB)
          Interrupt:17 Base address:0xd800

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
62.x.y.z      0.0.0.0         255.255.255.252 U         0 0          0 eth0
10.0.88.0       0.0.0.0         255.255.255.0   U         0 0          0 eth1
10.0.0.0        0.0.0.0         255.255.0.0     U         0 0          0 eth1
0.0.0.0         62.x.y.z+1      0.0.0.0         UG        0 0          0 eth0

[ igor.vitorac @ 25.02.2010. 08:52 ] @

Vidim da tu ima jedan detalj koji nisi pomenuo.. a to je da ta mashina (10.0.88.220) nema default gateway 10.0.88.1, vec 62.x.y.z+1

Dodaj na mashinu 10.0.88.220 rute ka mrezama:
10.0.10.0/24
10.0.11.0/24

I onda probaj.

[ indy @ 25.02.2010. 11:06 ] @

Igore, to je bilo to :)

S obzirom na to da sam na vr3 video pakete od 10.0.88.220, nikad ne bih ni pomislio da je problem u rutiranju na krajnjoj masini.

Hvala!

[ igor.vitorac @ 27.02.2010. 21:48 ] @

Vec nekolikom godina nisam radio sa pf-om, ali moja iskustva su: i odusevljenje i razocarenje...
Kada god sam hteo nesto "egzoticno" da uradim, uvek bi se "zakucao" u dokumentaciji koja je bila relativno siromasna... Ne znam da li se promenilo nesto u poslednje vreme.