#uname -a FreeBSD test 11.2-RELEASE-p14 FreeBSD 11.2-RELEASE-p14 #0 r351966: Sat Sep 7 01:29:14 CEST 2019 GENERIC amd64 # cat messages | grep "IP Filter" kernel: IP Filter: v5.1.2 initialized. Default = pass all, Logging = enabled # cat ipf.rules pass in quick all pass out quick all # cat ipnat.rules rdr igb0 xxx.xxx.xxx.xxx/32 port 80 -> yyy.yyy.yyy.yyy port 80 rdr igb0 xxx.xxx.xxx.xxx/32 port 443 -> yyy.yyy.yyy.yyy port 443 map igb0 xxx.xxx.xxx.xxx/32 -> xxx.xxx.xxx.xxx/32 proxy port ftp ftp/tcp map igb0 yyy.yyy.yyy.0/24 -> xxx.xxx.xxx.xxx/32 proxy port ftp ftp/tcp map igb0 yyy.yyy.yyy.0/24 -> xxx.xxx.xxx.xxx/32 portmap tcp/udp 40000:50000 map igb0 yyy.yyy.yyy.0/24 -> xxx.xxx.xxx.xxx/32 xxx.xxx.xxx.xxx -- IP on WAN interface igb0 yyy.yyy.yyy.yyy -- IP on LAN machine with http service yyy.yyy.yyy.0/24 -- LAN Some time after a lot of calls to the map rules: # ipfstat | egrep 'NAT failure' 158 input block reason IPv4 NAT failure 0 input block reason IPv6 NAT failure 0 output block reason IPv4 NAT failure 0 output block reason IPv6 NAT failure Some time after a lot of calls to the rdr rules: # ipfstat | egrep 'NAT failure' 159 input block reason IPv4 NAT failure 0 input block reason IPv6 NAT failure 267 output block reason IPv4 NAT failure 0 output block reason IPv6 NAT failure It is present both with the GENERIC kernel and a freshly installed system, and with a rebuilded kernel and world.
ipnat -lv output, please.
11.2-RELEASE does not have r338047, the bucket index fix. Update to 11.3-STABLE first, please. Or see PR/208566 for the fix.
(In reply to Cy Schubert from comment #2) Is this then affectively Closed->FIXED (committed in head, merged to affected stable branches, to come in next -RELEASE) ? It's fine not to keep issues Open until -RELEASE time, unless the issue is also an EN candidate and that hasn't been released to users yet
Yes, this was fixed in HEAD by r338047 on Aug 18, 2018. MFCed to 12-STABLE and 11-STABLE and 12-STABLE by r338171 three days later. It was included in releases/11.3.0 when it was branched. It will never be merged back into releng/11.2. The user may apply the patch from PR/208566 himself or it is recommended he update to 11-STABLE, which contains all the latest patches to HEAD (except VIMAGE).