# rdr (pf) doesn't work anymore on 10.2-Release



## Makoto Tanaka (Aug 18, 2015)

I have upgraded one of gateway server from FreeBSD10.1-RELEASE to FreeBSD10.2-RELEASE. I found critical issue on Port Forwarding rule on pf.

Here is scenario that you can reproduce the issue. I am on HOST01. I am trying to access the Server01 via GW01:10022.
HOST01 -> GW01: 10022 -> Server01:22

This is my pf.conf on GW01. This configuration was working on FreeBSD10.1-RELEASE-p17.
GW01 /etc/pf.conf:

```
rdr pass log on $ext_if proto tcp from any to ($ext_if) port 10022 -> {<HOST01>} port 22

block in log
pass out

pass in log on $ext_if proto tcp from any to ($ext_if) port 10022
```


```
[HOST01]$ ssh -p 10022 GW01
ssh: connect to host GW01 port 10022: Operation timed out
```

I found something is wrong with the packet between HOST01 and Server01.
Here is `tcpdump` output on server01.

```
[root@Server01]# tcpdump -v -i re0 host HOST01 and port 22

17:33:32.626650 IP (tos 0x0, ttl 64, id 28043, offset 0, flags [DF], proto TCP (6), length 60, bad cksum 0 (->37b7)!)
  Server01.ssh > HOST01.35723: Flags [S.], cksum 0x63b6 (correct), seq 1898239111, ack 1793874393, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 2315420046 ecr 98805561], length 0
17:33:32.626984 IP (tos 0x0, ttl 64, id 29836, offset 0, flags [DF], proto TCP (6), length 52)
  HOST01.35723 > Server01.ssh: Flags [.], cksum 0x8e70 (correct), ack 1, win 1040, options [nop,nop,TS val 98805562 ecr 2315420046], length 0
17:33:32.632417 IP (tos 0x0, ttl 64, id 28048, offset 0, flags [DF], proto TCP (6), length 101, bad cksum 0 (->3789)!)
  Server01.ssh > HOST01.35723: Flags [P.], cksum 0x1bba (correct), seq 1:50, ack 1, win 1040, options [nop,nop,TS val 2315420052 ecr 98805562], length 49
17:33:32.632673 IP (tos 0x0, ttl 64, id 29849, offset 0, flags [DF], proto TCP (6), length 74)
  HOST01.35723 > Server01.ssh: Flags [P.], cksum 0x07b9 (correct), seq 1:23, ack 50, win 1040, options [nop,nop,TS val 98805567 ecr 2315420052], length 22
17:33:32.632678 IP (tos 0x0, ttl 64, id 29850, offset 0, flags [DF], proto TCP (6), length 52)
  HOST01.35723 > Server01.ssh: Flags [F.], cksum 0x8e1d (correct), seq 23, ack 50, win 1040, options [nop,nop,TS val 98805567 ecr 2315420052], length 0
17:33:32.632683 IP (tos 0x0, ttl 64, id 28049, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 0 (->37b9)!)
  Server01.ssh > HOST01.35723: Flags [.], cksum 0x8e1d (correct), ack 24, win 1040, options [nop,nop,TS val 2315420052 ecr 98805567], length 0
```

If the destination is GW01:22 via GW01:10022 doesn't have any issue.

GW01 /etc/pf.conf:

```
rdr pass log on $ext_if proto tcp from any to ($ext_if) port 10022 -> {<GW01>} port 22

block in log
pass out

pass in log on $ext_if proto tcp from any to ($ext_if) port 10022
```
Is anyone having same experience with 10.2-Release?


----------



## devil_devil (Aug 18, 2015)

pf.conf()


----------



## kpa (Aug 18, 2015)

Can you test if the rdr works by separating the rdr rule and the pass rule as separate rules.


----------



## devil_devil (Aug 18, 2015)

Try


```
gw_ip = ""
ext_if = ""
rdr pass on $ext_if proto tcp from any to $ext_if port 10022 -> $gw_ip port 22
block in log on $ext_if all
```


----------



## Makoto Tanaka (Aug 18, 2015)

kpa said:


> Can you test if the rdr works by separating the rdr rule and the pass rule as separate rules.


It looks same behavior. No difference.


----------



## Makoto Tanaka (Aug 18, 2015)

devil_devil said:


> Try
> 
> 
> ```
> ...



That is working. As long as the destination is same host, it is working.


----------

