<div dir="ltr">Hi,<div><br></div><div>The problem occurs in the following scenario where two hosts A and B are in use on the lan and connected to a router which is doing masquerade on the wan link.</div><div>Host A has a private IP@ (eg <a href="http://192.168.1.10/24">192.168.1.10/24</a>) while host B has a public IP@ (eg <a href="http://172.18.16.240/24" target="_blank">172.18.16.240/24</a>); the router has a public IP@ on the wan in the same subnet as host B (eg <a href="http://172.18.16.245/24" target="_blank">172.18.16.245/24</a>).</div><div>A redirect rule is defined on the router to forward tcp service 8080 to host A port 80 and translates into following iptables nat rules :</div><div><br></div><div><div>Chain delegate_prerouting (1 references)</div><div> pkts bytes target prot opt in out source destination </div><div> 2 68 prerouting_rule all -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> /* user chain for prerouting */</div><div> 1 32 zone_lan_prerouting all -- br-lan * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div><div> 0 0 zone_wan_prerouting all -- pppoe-wan * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div><div><br></div><div>chain zone_wan_prerouting (1 references)</div><div> pkts bytes target prot opt in out source destination </div><div> 0 0 prerouting_wan_rule all -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> /* user chain for prerouting */</div><div> 0 0 DNAT tcp -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp spt:8080 /* @redirect[0] */ to:<a href="http://192.168.1.10:80">192.168.1.10:80</a></div></div><div><br></div><div> </div><div>TCP traffic on pppoe-wan interface with as destination port 172.18.16.245 will be redirected to 192.168.1.10 as expected but if host B runs a similar tcp service on port 8080 it will be unreachable as traffic directed to 172.18.16.240 will also be re-directed to 192.168.1.10.</div><div>The patch tries to fix this issue by using the wan IP address in the zone_wan_prerouting lookup; in this case traffic destined for 172.18.16.240 will not be redirected. </div><div><div>Chain delegate_prerouting (1 references)</div><div> pkts bytes target prot opt in out source destination </div><div> 1 87 prerouting_rule all -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> /* user chain for prerouting */</div><div> 1 87 zone_lan_prerouting all -- br-lan * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div><div> 0 0 zone_wan_prerouting all -- pppoe-wan * <a href="http://0.0.0.0/0">0.0.0.0/0</a> 172.18.16.245 </div><div><br></div><div>Chain zone_wan_prerouting (1 references)</div><div> pkts bytes target prot opt in out source destination </div><div> 0 0 prerouting_wan_rule all -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> /* user chain for prerouting */</div><div> 0 0 DNAT tcp -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp spt:8080 /* @redirect[0] */ to:<a href="http://192.168.1.10:80">192.168.1.10:80</a></div></div><div><br></div><div>Output of fw3 print diff before/after the patch</div><div><br></div><div><div>< iptables -t nat -D delegate_prerouting -i pppoe-wan -j zone_wan_prerouting</div><div>< iptables -t nat -A delegate_prerouting -i pppoe-wan -j zone_wan_prerouting</div><div>---</div><div>> iptables -t nat -D delegate_prerouting -i pppoe-wan -d <a href="http://172.18.16.245/255.255.255.255">172.18.16.245/255.255.255.255</a> -j zone_wan_prerouting</div><div>> iptables -t nat -A delegate_prerouting -i pppoe-wan -d <a href="http://172.18.16.245/255.255.255.255">172.18.16.245/255.255.255.255</a> -j zone_wan_prerouting</div></div><div><br></div><div>Bye,</div><div>Hans</div><div><br></div><div><div class="gmail_extra"><div class="gmail_quote">On Thu, Oct 1, 2015 at 10:05 PM, Jo-Philipp Wich <span dir="ltr"><<a href="mailto:jow@openwrt.org" target="_blank">jow@openwrt.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hi,<br>
<br>
wouldn't this break port forwards to hosts not being within the range of<br>
the on-link lan subnet?<br>
<br>
I also read the patch description three times and still am not sure what<br>
that change attempts to achive.<br>
<br>
Can you further explain the problem please and provide a before/after<br>
"fw3 print" diff so that I better understand your proposed solution?</blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
~ Jow<br>
<div><div><br>
</div></div></blockquote></div><br></div></div></div>