Bug 199489 - NAT with IPv6 and PF round robins between external address and link-local address
Summary: NAT with IPv6 and PF round robins between external address and link-local add...
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 10.1-RELEASE
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-net (Nobody)
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2015-04-16 22:46 UTC by Shawn Michael
Modified: 2019-02-01 13:43 UTC (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Shawn Michael 2015-04-16 22:46:31 UTC 
Using NAT with IPv6 round robins each tcp session between link-local and the actual external IP.

My setup is using openconnect attached to tun1 to allow my local private network access over the VPN to our data centers.  From the remote side I am getting both and IPv4 and an IPv6 address (single address in both instances).  So in order for my local  network to communicate with the remote side I have to NAT everything to the address that tun1 gets assigned.

What I am observing is that every other connection using IPv6 and NAT works.  The ones that work end up using the public IPv6 IP address.  The ones that don't end up with a NAT of the link-local address.

The pf.conf rule that is triggering this behavior is:

nat on tun1 inet6 from fc00::c0a8:fa00/120 to any -> (tun1)

The expected behavior would be to ignore the link-local address.  Or better yet have (tun1:0) reference the routable IP and not link-local.

I have found a reference in the email lists to this problem with a possible patch:

http://lists.freebsd.org/pipermail/freebsd-pf/2014-September/007441.html
Comment 1 Kristof Provost freebsd_committer freebsd_triage 2019-02-01 13:43:08 UTC 
I believe this was fixed in #201695. Please re-open this bug if that's not the case.