summaryrefslogtreecommitdiffstats
path: root/docs/etc
diff options
context:
space:
mode:
authorMatthew Smith <mgsmith@netgate.com>2020-01-16 13:48:52 -0600
committerAndrew Yourtchenko <ayourtch@gmail.com>2020-01-24 00:30:47 +0000
commitd539e256b212240f71fb81092f2e24d96c737127 (patch)
treef9c40eb4f43c770903e7afb1f739a9a7d389bd55 /docs/etc
parentddb90a063cb3fa797257d8a632cba8cf2a01a455 (diff)
nat: in2out-output nodes work with acl reflect
Type: feature The current feature ordering of NAT44 nodes with respect to the ACL plugin's IPv4 input/output features is: ip4-output: acl-plugin-out-ip4-fa runs before any NAT44 nodes ip4-unicast: acl-plugin-in-ip4-fa runs before any NAT44 nodes ACL rules with action permit+reflect can keep track of outbound flows and allow the replies inbound without an explicit inbound rule. If ACL permit+reflect rules are configured on an interface that also has NAT44 configured with output-feature/postrouting translation of outbound packets, the ACL rules cannot allow inbound packets. The ACL state that was stored on the outbound flow contains the IP addresses of the original packet, prior to translation. The inbound packets are being evaluated by the ACL node using the translated addresses. The order of processing inbound needs to be the opposite of what it was outbound for this to work. Change the NAT44 features on ip4-output so that they run before outbound ACL nodes. This matches the existing behavior of the NAT44 nodes which rewrite source addresses as an input feature instead of an output feature. This was only done for endpoint dependent mode because the regular endpoint independent in2out-output node currently selects an explicit next node rather than using the next node on the feature arc. Unit test added to configure both NAT and an ACL and ensure that out2in packets matching an in2out flow are permitted by the ACL and translated by NAT. Change-Id: Ibd679c28b64c3fc3cc8c0606ea93123e384e839f Signed-off-by: Matthew Smith <mgsmith@netgate.com>
Diffstat (limited to 'docs/etc')
0 files changed, 0 insertions, 0 deletions