Home > IT Answers > Linux > problem with ip forwarding on openbsd
astronomer
0 pts.
 problem with ip forwarding on openbsd
Linux
We are currently building two new servers as openbsd firewalls. During our testing, connectivity broke. We have disabled pf so it won't cause problems.
In our ping tests we found the packets aren't getting forwarded. ipforwarding is set to 1. When we ran netstat -r we found it takes forever, (more than ten minutes so far), to display the routes on the interfaces.
From both sides we can ping into the far side of the firewall but not any devices on the same net as the far side of the firewall.
Is there anyplace else where routing can get messed up? I'm reaching the point of doing a re-install but would like to know how this could happen.
Thanks.
rt
ASKED: Sep 6, 2005  7:40 PM GMT
UPDATED: September 14, 2005  4:15:36 PM GMT
RELATED QUESTIONS
this213
0 pts.
Answer Wiki:
What does netstat -nr show? If it comes up right away, you most likely have a reverse DNS issue.
Last Wiki Answer Submitted:  Sep 11, 2005  3:47 AM (GMT)  by  this213   0 pts.
To see other answers submitted to the Answer Wiki View Answer History.
RSS - Discussions Help
Discuss This Question:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _



 

Thanks for the response. We rebuilt the box from scratch. Now we seem to have connectivity.

One thing we noticed is netstat -r takes forever to execute on the bsd 3.7 system, even after we rebuilt it. Is this normal? On the existing system running 3.5 it executes immediately. The old system is an obsolete gateway workstation. The new boxes are dell 1850 servers.

We haven’t configured DNS and all rules are based on IP. We have static routes pointing to the external router as default and the pix as the route to our internal net. This worked well for BSD 3.5 although we have had hardware reliability issues with the old workstations.
rt

astronomer
 0 pts.
 

If the machine’s not coming back with its own routes immediately (or almost immediately), there’s a problem somewhere.

You mentioned you were building this as a firewall, I would assume your rules are to dump anything you don’t explicitly allow - have you allowed localhost (127.0.0.1) traffic? What happens if you apply your ruleset to one of the other boxes?

As a side note, I believe that disabling pf still does not open your system up, try “iptables -L” to make sure.

this213
 0 pts.
 

During our connectivity tests we have pf disabled. iptables isn’t a part of OpenBSD. When I run netstat -r, it takes about 19 minutes to display the ipv4 routes. default, loopback, and localhost happen immediately. In our tests, we haven’t tried anything requiring another hop yet, but pings to adjacent systems don’t seem to be a problem.
Thanks.
rt

astronomer
 0 pts.
 

I think I figured out the netstat issue. On our test lab we aren’t running DNS. When I ran netstat -rn the table scrolled by immediately. I believe the system was trying to find DNS names for the addresses in the route table.
Thanks for the responses. Now all I have to figure out is why one of our linux test boxes will ping out but doesn’t respond to pings,(even after changing the hardware and rebuilding from scratch). This was the source of much confusion during our connectivity tests.
rt

astronomer
 0 pts.