Responses to outbound IP4 packets on WAN interface (igb1) of HA backup system are blocked.
Either because all private addresses are blocked.
If I allow private addresses on WAN interface, they are bolcked by state violation rule.
Why is no state created ?
Do I need a 2nd NAT rule, because the WAN VIP is not available at backup firewall ?
There is only one outbound NAT rule:
All source addresses are NATed.
Outbound NAT-address is the WAN VIP
igb1: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
description: WAN (wan)
options=4802028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,HWSTATS,MEXTPG>
ether 00:0d:b9:4f:fd:a1
inet 192.168.178.12 netmask 0xffffff00 broadcast 192.168.178.255
inet 192.168.178.2 netmask 0xffffff00 broadcast 192.168.178.255 vhid 1
inet6 fe80::20d:b9ff:fe4f:fda1%igb1 prefixlen 64 scopeid 0x2
inet6 2003:cb:170c:9700:20d:b9ff:fe4f:fda1 prefixlen 64 autoconf pltime 1799 vltime 7200
inet6 fd77:8819:994b:0:20d:b9ff:fe4f:fda1 prefixlen 64 autoconf pltime 3600 vltime 7200
carp: BACKUP vhid 1 advbase 1 advskew 100
peer 224.0.0.18 peer6 ff02::12
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
Ping to VDSL-Router (FB) shows:
root@opn2:~ # ping -S 192.168.178.12 192.168.178.1
PING 192.168.178.1 (192.168.178.1) from 192.168.178.12: 56 data bytes
^C
root@opn2:~ # tcpdump -nves 300 -i igb1 icmp
tcpdump: listening on igb1, link-type EN10MB (Ethernet), snapshot length 300 bytes
18:31:25.136468 00:0d:b9:4f:fd:a1 > cc:ce:1e:b3:75:7f, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 19554, offset 0, flags [none], proto ICMP (1), length 84)
192.168.178.2 > 192.168.178.1: ICMP echo request, id 17147, seq 0, length 64
root@opn2:~ # tcpdump -nves 300 -i pflog0 icmp
tcpdump: listening on pflog0, link-type PFLOG (OpenBSD pflog file), snapshot length 300 bytes
18:27:33.276553 rule 200/0(match): block in on igb1: (tos 0x0, ttl 63, id 56317, offset 0, flags [none], proto ICMP (1), length 84)
192.168.178.2 > 192.168.178.12: ICMP echo reply, id 49522, seq 6, length 64
Why seem responses come from the WAN VIP instead from FB ?
Which rules are needed to allow outgoing IP4 traffic of backup system ?
Current rules related to igb1 attached.
Please advice,
ajr
What do your outbound NAT rules look like?
Did override its outbound behavior with a manual rule by any chance?
Quote from: viragomann on July 24, 2025, 09:23:22 PMWhat do your outbound NAT rules look like?
See atachment.
QuoteDid override its outbound behavior with a manual rule by any chance?
I'm not aware of any.
Do you want look at my complete rules set (per PM) ?
ajr
QuoteQuote from: viragomann on July 24, 2025, 09:23:22 PM
What do your outbound NAT rules look like?
See atachment.
I seem to miss the attachment (still struggling with the formum GUI).
Here it comes.
ajr