NetBSD's npf port forwarding

lib7

Hi,

My router/firewall to the external world runs NetBSD.
I'm trying to do the forwarding of port 17106 to 192.168.1.30, but to no success, yet.

The result of nfpctl validate is as follows:

table <int-block> type lpm

procedure "log"

map ure0 dynamic any -> ifaddrs(ure0) pass family inet4 from 192.168.1.0/24 # id="0" 
map ure0 dynamic any -> ifaddrs(ure0) port 17106 pass family inet4 proto { tcp, udp } from 192.168.1.0/24 port 17106 # id="0" 
map ure0 dynamic 192.168.1.30 port 17106 <- any pass family inet4 proto { tcp, udp } to $my_external_ip(not shown) port 17106 # id="0" 

group "external" on ure0 { # id="0" 
        pass stateful out final flags S/FSRA # id="0" 
        pass stateful in final family inet4 proto tcp flags S/FSRA to ifaddrs(ure0) port 22 apply "log" # id="0" 
        pass stateful in final proto tcp flags S/FSRA to ifaddrs(ure0) port { 80, 443, 25, 53, 6000, 9022 } # id="0" 
        pass stateful in final proto udp to ifaddrs(ure0) port { 53, 123, 6000 } # id="0" 
        pass stateful in final proto tcp flags S/FSRA to ifaddrs(ure0) port 17106 # id="0" 
        pass stateful in final proto udp to ifaddrs(ure0) port 17106 # id="0" 
        pass stateful out final flags S/FSRA # id="0" 
}

group "internal" on re0 { # id="0" 
        pass in final family inet4 from 192.168.1.0/24 # id="0" 
        pass out final all # id="0" 
}

group default { # id="0" 
        pass final on lo0 all # id="0" 
        block all # id="0" 
}

What's wrong or missing with this setup?

JuvenalUrbino

lib7 I'm trying to do the forwarding of port 17106 to 192.168.1.30, but to no success, yet

map ure0 dynamic any -> ifaddrs(ure0) pass family inet4 from 192.168.1.0/24 # id="0"

I may be wrong, but this looks like a recurrent outbound NAT

Should be as easy as:

$ext_ip="$my_external_ip"
$localnet = { 192.168.1.0/24 }

map ure0 dynamic $localnet -> $ext_ip
map ure0 dynamic  192.168.1.30 port 17106 <- $ext_ip port 17106

Also make sure IP forwarding is enabled:

sysctl -w net.inet.ip.forwarding=1
echo net.inet.ip.forwarding=1 >> /etc/sysctl.conf

lib7

Tried that, but doesn't work.

Also added a similar rule as
map ure0 dynamic 192.168.1.30 port 22222 <- any pass family inet4 proto { tcp, udp } to $my_external_ip port 22222 # id="3"

Doesn't work either.

Forgot to mention, but, yes, net.inet.ip_forwarding is 1

JuvenalUrbino

What does npfctl show return?

lib7

# npfctl show
# filtering:    active
# config:       loaded

table <int-block> type lpm

procedure "log"

map ure0 dynamic any -> ifaddrs(ure0) pass family inet4 from 192.168.1.0/24 # id="1" 
map ure0 dynamic 192.168.1.30 port 17106 <- any pass family inet4 proto { tcp, udp } to $my_external_ip  port 17106 # id="2" 
map ure0 dynamic 192.168.1.30 port 22222 <- any pass family inet4 proto { tcp, udp } to $my_external_ip port 22222 # id="3" 

group "external" on ure0 { # id="1" 
        pass stateful out final flags S/FSRA # id="2" 
        pass stateful in final family inet4 proto tcp flags S/FSRA to ifaddrs(ure0) port 22 apply "log" # id="3" 
        pass stateful in final proto tcp flags S/FSRA to ifaddrs(ure0) port { 80, 443, 25, 53, 6000, 9022 } # id="4" 
        pass stateful in final proto udp to ifaddrs(ure0) port { 53, 123, 6000 } # id="5" 
        pass stateful out final flags S/FSRA # id="6" 
}

group "internal" on re0 { # id="7" 
        pass in final family inet4 from 192.168.1.0/24 # id="8" 
        pass out final all # id="9" 
}

group default { # id="a" 
        pass final on lo0 all # id="b" 
        block all # id="c" 
}

$my_external_ip is just a placeholder here not to show my real IP

JuvenalUrbino

Premise: I haven't done NAT on NPF since like NetBSD 7.x and unfortunately I no longer run a NPF-based home router (switched to ISP's as I moved over a optical fiber connection).

Nevertheless, I decided to perform some tests on one of my machines and check whether what used to apply back then still does (NPF changes fast).
My legacy IBM thinkpad has a statically assigned internal address, which is 192.168.1.3. I decided to make sshd listen on 2200, which results in being cut out when trying to get a remote shell on it through the standard 22 TCP port.

$ ssh 192.168.1.3
ssh: connect to host 192.168.1.3 port 22: Connection refused

Now, I'll edit my /etc/npf.conf to do inbound IP forwarding from port 22 to 2200 (without explicitely allowing requests on 2200)

   $int_if = inet4(fxp0) 
   $int_IP = { 192.168.1.3 }  
   # translate inbound requests from port 22 to 2200
   map fxp0 dynamic $int_IP port 2200 <- $int_IP port 22

Which once loaded generates:

$ npfctl show
[...]
map fxp0 dynamic 192.168.1.3 port 2200 <- any pass family inet4 proto { tcp, udp } to 192.168.1.3 port 22 # id="2"
[...]

Looks like it will let me in now:

$ ssh 192.168.1.3
Password for vincent@thinkpad_R51.sdf.org:
Last login: Sat Mar 27 09:24:26 2021 from 192.168.1.35
NetBSD 9.1 (GENERIC) #0: Sun Oct 18 19:24:30 UTC 2020

Looking ath the npfd log, I see:

$ tcpdump -enr /var/log/npflog0.pcap
[...]
09:25:01.482352 rule 15.rules.0/0(match): pass in on fxp0: 192.168.1.35.41366 > 192.168.1.3.2200: Flags [.], ack 7108, win 1815, options [nop,nop,TS val 7572469 ecr 24], length 0
09:25:02.470493 rule 15.rules.0/0(match): pass out on fxp0: 192.168.1.3.22 > 192.168.1.35.41366: Flags [P.], seq 7108:7240, ack 1566, win 4197, options [nop,nop,TS val 26 ecr 7572469], length 132

Which accounts for the fact the NAT is properly set up.

As a counter-proof, I comment the map line in my npf.conf, I'm rejected again, and the npfd log shows:

09:31:29.826419 rule 21.rules.0/0(match): block in on fxp0: 192.168.1.35.41366 > 192.168.1.3.22: Flags [FP.], seq 1566:1954, ack 7324, win 1849, options [nop,nop,TS val 7579810 ecr 16], length 388

So, at least we know it should work,

Now, as I mentioned above, this:

lib7 map ure0 dynamic any -> ifaddrs(ure0) pass family inet4 from 192.168.1.0/24 # id="1"

looks like a malformed outbound NAT; the internal network show be directly mapped to the public IP of the internet-facing NIC (or to a generic inet4(ure0) list if the address assigned to the interface is one and one only), not to the dynamic net-seg assigned to it by the local DHCP server.

Would you mind editing your configuration as I posted above?

map ure0 dynamic $localnet -> $my_external_ip

Which should result in:

map ure0 dynamic any -> $my_external_ip pass family inet4 from 192.168.1.0/24 # id="1"

In addition, is your internal DNS properly configured and working?
Is the target device on 192.168.1.30 actually listening on 17106?

lib7

Hi JuvenalUrbino, thank very much for your help and time.
There's something happening that still prevents the port forwarding.

Regarding your final questions:

Yes, 192.168.1.30 is listening on 17106.
From the netbsd router/firewall:

$ curl http://192.168.1.30:17106
<!DOCTYPE html>
<html lang="en" >

In the text below, wrote 3.3.3.3 as my IP for things to be clearer.

I rebooted the machine to get access in /var/log/messages to some info regarding dhcpd.

Internet Systems Consortium DHCP Server 4.3.3
(...)
Wrote 139 leases to leases file.
No subnet declaration for ure0 (3.3.3.3).
** Ignoring requests on ure0.  If this is not what
you want, please write a subnet declaration
in your dhcpd.conf file for the network segment
to which interface ure0 is attached. **
netpi dhcpd[372]: 
netpi dhcpd[372]: Server starting service

Everything I needed was working, so I never paid much attention to this, as I no expert in dhcpd.

The /etc/dhcpd.conf file is as:

# grep -v '^#' /etc/dhcpd.conf  
option domain-name "home.lan";
option domain-name-servers 127.0.0.1;
default-lease-time 7200;
max-lease-time 2592000;
authoritative;
ddns-update-style none;
log-facility local7;

subnet 192.168.1.0 netmask 255.255.255.0 {
  range 192.168.1.110 192.168.1.250;
  option routers 192.168.1.253;
  option domain-name "home.lan";
  option domain-name-servers 127.0.0.1;
  default-lease-time 1000000;
  max-lease-time 2592000;
}

Regarding npf rules, sorry if I didn't understand you in first place.

I placed ifaddrs because the IP is dynamic. And it's stated that dynamic list NPF will capture the runtime list of addresses, reflecting any changes to the interface, in the npf configuration webpage

I edited the rule as you suggested, took the ifaddrs(ure0) and placed a inet4(ure0).
The line id=1 looks like yours.

# npfctl show
# filtering:    active
# config:       loaded

table <int-block> type lpm

procedure "log"

map ure0 dynamic any -> 3.3.3.3 pass family inet4 from 192.168.1.0/24 # id="1" 
map ure0 dynamic 192.168.1.30 port 17106 <- any pass family inet4 proto { tcp, udp } to 3.3.3.3 port 17106 # id="2" 
map ure0 dynamic 192.168.1.30 port 22222 <- any pass family inet4 proto { tcp, udp } to 3.3.3.3 port 22222 # id="3" 

group "external" on ure0 { # id="1" 
        pass stateful out final flags S/FSRA # id="2" 
        pass stateful in final family inet4 proto tcp flags S/FSRA to ifaddrs(ure0) port 22 apply "log" # id="3" 
        pass stateful in final proto tcp flags S/FSRA to ifaddrs(ure0) port { 80, 443, 25, 53, 6000, 9022 } # id="4" 
        pass stateful in final proto udp to ifaddrs(ure0) port { 53, 123, 6000 } # id="5" 
        pass stateful out final flags S/FSRA # id="6" 
}

group "internal" on re0 { # id="7" 
        pass in final family inet4 from 192.168.1.0/24 # id="8" 
        pass out final all # id="9" 
}

group default { # id="a" 
        pass final on lo0 all # id="b" 
}

Still, port forwarding is not possible.

lib7

Just to add that

# tcpdump -enr /var/log/npflog0.pcap | grep 17106
reading from file /var/log/npflog0.pcap, link-type PFLOG (OpenBSD pflog file)

JuvenalUrbino

Sorry if I didn't follow up on this earlier, been sort of stressed

lib7 I though the implicitly referred to the packet filtering but it doesn't.

I had to learn this the hard way too, as I made the same miscalculation once. TBH, when I stated:

Now, I'll edit my /etc/npf.conf to do inbound IP forwarding from port 22 to 2200 (without explicitely allowing requests on 2200)

I also implicitly implied 22 to be allowed

lib7 Just to add that
tcpdump -enr /var/log/npflog0.pcap | grep 17106
reading from file /var/log/npflog0.pcap, link-type PFLOG (OpenBSD pflog file)

You probably need to enable npfd npfd(8) and apply a "log" procedure (which it would appear you already configured in your config) to the desired filter rules to watch on

Anyway, glad you sorted this out!

lib7

It worked after this line was added.
pass stateful in final to ifaddrs(ure0) port 17106

Previously it was there, don't know why it hasn't worked at that time.

At a certain point, I thought that the pass was implicit, because in the npf documentation, it's stated that

map $ext_if dynamic $local_host_2 port 80 <- $ext_if port 8080
In the examples above, NPF determines the filter criteria from the segments on the left and right hand side implicitly.

I though the implicitly referred to the packet filtering but it doesn't.
The filter criteria mentioned in the documentation is for the translation rule. Such rule doesn't implicitly pass the traffic, as the author of npf wrote.