Netbsd 6 NPF npfctl stats and logging

[Mike C.]

Hi all,

I've been testing with NPF, but since I could not find much
documentation except the man pages I have some doubts.

First and if this somehow changes anything I'd like to refer I'm testing
this on a NetBSD 6.0 BETA 2 Xen domU.

I've recompiled the kernel adding npf support but I can't seem to get
the logging woring nor I see anything in npfctl stats.

npfctl stats
Packets passed:
0 default pass
0 ruleset pass
0 session pass

Packets blocked:
0 default block
0 ruleset block

Session and NAT entries:
0 session allocations
0 session destructions
0 NAT entry allocations
0 NAT entry destructions

Invalid packet state cases:
0 cases in total
0 TCP case I
0 TCP case II
0 TCP case III

Packet race cases:
0 NAT association race
0 duplicate session race

Rule processing procedure cases:
0 packets logged
0 packets normalized

Unexpected error cases:
0


tcpdump show nothing for the interface npflog0, the interface is created
and UP:

# ifconfig npflog0
npflog0: flags=1<UP>


Am I missing anything trivial? If so sorry for taking your time, but any
help will be very much appreciated.

I'm just using the example config in the man page.



And if I may add another question, I get this error:
# npfctl
reload

/etc/npf.conf:15:47: multiple addresses are not valid near '$ext_if'

what's the correct syntax in this case? I've tried:

nat $ext_if from 192.168.100.0/24 to any -> ($ext_if)

But in this case It complains about the "(" so its obviously not the
correct syntax!


Thank you





--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Mindaugas Rasiukevicius]

Hello,

Post by Mike C.
I've been testing with NPF, but since I could not find much
documentation except the man pages I have some doubts.
...
# npfctl
reload

Did you run "npfctl start" after (re)load?

Post by Mike C.
/etc/npf.conf:15:47: multiple addresses are not valid near '$ext_if'

It should be clarified, but the reason is that $ext_if has multiple IP
addresses (if IPv6 is enabled, that is already the case). Therefore, NPF
does not know which address to use for the translation. Try to specify
the address explicitly. More convenient way to select some address of
an interface would be useful (suggestions for syntax are welcome).

Note that the syntax has changed in -current (they will also appear in
netbsd-6 once the changes are pulled up). Check the man page for the
changes. Your NAPT rule would be the following (where $nataddr is your
external/translation address):

map $ext_if dynamic $localnet -> $nataddr

[Mike]

Post by Mindaugas Rasiukevicius
Hello,

Post by Mike C.
I've been testing with NPF, but since I could not find much
documentation except the man pages I have some doubts.
...
# npfctl
reload

Did you run "npfctl start" after (re)load?

I did and it didn't work, no I'm getting a kernel panic when starting
it, I guess I should wait for the changes on netbsd-6 or try this on
current.

Post by Mindaugas Rasiukevicius

Post by Mike C.
/etc/npf.conf:15:47: multiple addresses are not valid near '$ext_if'

It should be clarified, but the reason is that $ext_if has multiple IP
addresses (if IPv6 is enabled, that is already the case). Therefore, NPF
does not know which address to use for the translation. Try to specify
the address explicitly. More convenient way to select some address of
an interface would be useful (suggestions for syntax are welcome).

Yes I did that, because this interface is dhcp assigned, and it worked.
Btw on pf.conf the syntax for this scenario would be to use "()" like ->
($ext_if)

Post by Mindaugas Rasiukevicius
Note that the syntax has changed in -current (they will also appear in
netbsd-6 once the changes are pulled up). Check the man page for the
changes. Your NAPT rule would be the following (where $nataddr is your
map $ext_if dynamic $localnet -> $nataddr

Nice to know, well more and more I think it might be best to move to
-current

Thanks for the help

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de