Bug 33371
| Summary: | ipnat(5) requires mapped-to port in rdr rules | ||
|---|---|---|---|
| Product: | Documentation | Reporter: | Matthew Whelan <muttley> |
| Component: | Books & Articles | Assignee: | guido |
| Status: | Closed FIXED | ||
| Severity: | Affects Only Me | ||
| Priority: | Normal | ||
| Version: | Latest | ||
| Hardware: | Any | ||
| OS: | Any | ||
please try this patch (I hope this sends using this program LOL, if not i'll resubmit) *** ipnat.5 Mon Dec 31 10:27:35 2001 --- ipnat.5.new Mon Dec 31 10:26:18 2001 *************** *** 10,16 **** map ::= mapit ifname ipmask "->" ipmask [ mapport ] . map ::= mapit ifname fromto "->" ipmask [ mapport ] . mapblock ::= "map-block" ifname ipmask "->" ipmask [ ports ] . ! redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] [ ports ] options . dport ::= "port" portnum [ "-" portnum ] . ports ::= "ports" numports | "auto" . --- 10,16 ---- map ::= mapit ifname ipmask "->" ipmask [ mapport ] . map ::= mapit ifname fromto "->" ipmask [ mapport ] . mapblock ::= "map-block" ifname ipmask "->" ipmask [ ports ] . ! redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] ports options . dport ::= "port" portnum [ "-" portnum ] . ports ::= "ports" numports | "auto" . Responsible Changed From-To: freebsd-doc->guido Guido, could you please look into it? State Changed From-To: open->feedback In ipf-3.4-current, a fix is in place. I want to wait until the release based on that version is imported. Btw: the patch in the PR is not completely riht. This is what it should have been: -redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] [ ports ] options . +redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] rdrport options . +rdrport ::= "port" portnum . State Changed From-To: feedback->closed As the original patch submitter, I've just checked the ipnat(5) manual page on my STABLE box and this has been fixed. Thanks! |
The ipnat(5) man page is inconsistent with actual behaviour for redirection (rdr) rules. From ipnat(5): redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] [ ports ] options and options ::= [ tcpudp ] [ rr ] But if you try to omit the [ ports ]: root@ericnernie# ipnat -n -f - rdr tun0 0/32 port 7010-7019 -> 192.168.0.3 1: No netmask supported in destination host for redirect 1: syntax error in "rdr" rdr tun0 0/32 port 7010-7019 -> 192.168.0.3 tcp 2: missing fields - 2nd port (tcp) 2: syntax error in "rdr" rdr tun0 0/32 port 7010-7019 -> 192.168.0.3 port 7010 tcp Fix: Amend the manpage so that redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] [ ports ] options reads as redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] ports options How-To-Repeat: N/A