npf forwarding <-

[Patrick Welche <prlw1%cam.ac.uk@localhost>]

How is npf <- meant to work? This is the simplest test rig I could think of:

# rpi                          laptop                    webserver
# NetBSD-8.99.25/evbarm        NetBSD-8.99.25/amd64      NetBSD-8.99.25/amd64
# usmsc0 10.168.204.26/24 <--> wm0 10.168.204.62/24 
#                              iwm0 10.111.65.65/24 <--> wm0 10.111.65.4/24

$ext_if = "iwn0"
$int_if = "wm0"

$ext_v4 = inet4($ext_if)
$int_v4 = inet4($int_if)

alg "icmp"

procedure "log" {
        log: npflog0
}

map $ext_if dynamic $int_net -> $ext_v4
map $int_if dynamic 10.111.65.4 <- 128.232.132.8

group "external" on $ext_if {
        pass stateful out final all apply "log"
        pass all apply "log"
}

group "internal" on $int_if {
        pass stateful final all apply "log"
        pass all apply "log"
}
 
group "local" on "lo0" {
        pass all apply "log"      
}       
        
group default {
        pass all apply "log"
}       


On the rpi, lynx http://webserver/ gets the page successfully.
However, lynx http://128.232.132.8/ hangs. On the laptop,
tcpdump -nvi wm0 shows:

12:05:59.236370 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    10.168.204.26.65517 > 128.232.132.8.80: Flags [S], cksum 0x9dbf (correct), seq 1728898885, win 32768, options [mss 1460,nop,wscale 3,sackOK,TS val 1 ecr 0], length 0
12:05:59.236439 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto ICMP (1), length 56, bad cksum 0 (->e1c)!)
    10.168.204.62 > 10.168.204.26: ICMP host 10.111.65.4 unreachable, length 36
        IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    10.168.204.26.65517 > 10.111.65.4.8096: [|tcp]
12:06:05.238546 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    10.168.204.26.65517 > 128.232.132.8.80: Flags [S], cksum 0x9db3 (correct), seq 1728898885, win 32768, options [mss 1460,nop,wscale 3,sackOK,TS val 13 ecr 0], length 0
12:06:05.238638 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto ICMP (1), length 56, bad cksum 0 (->e1c)!)
    10.168.204.62 > 10.168.204.26: ICMP host 10.111.65.4 unreachable, length 36
        IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    10.168.204.26.65517 > 10.111.65.4.8096: [|tcp]
12:06:17.248729 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    10.168.204.26.65517 > 128.232.132.8.80: Flags [S], cksum 0x9d9b (correct), seq 1728898885, win 32768, options [mss 1460,nop,wscale 3,sackOK,TS val 37 ecr 0], length 0
12:06:17.248802 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto ICMP (1), length 56, bad cksum 0 (->e1c)!)
    10.168.204.62 > 10.168.204.26: ICMP host 10.111.65.4 unreachable, length 36
        IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    10.168.204.26.65517 > 10.111.65.4.8096: [|tcp]

rpi# ping -c1 10.111.65.4
PING warbler.flow.bpi.cam.ac.uk (10.111.65.4): 56 data bytes
64 bytes from 10.111.65.4: icmp_seq=0 ttl=254 time=4.833378 ms

----warbler.flow.bpi.cam.ac.uk PING Statistics----
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 4.833378/4.833378/4.833378/0.000000 ms


What am I missing?


Cheers,

Patrick