OpenBSD Journal

BREAKING pf(4) change: change route-to so it sends packets to IPs instead of interfaces.

Contributed by Peter N. M. Hansteen on from the route me up before you go-go dept.

Does your pf configuration have route-to rules? If so, you need to consider the implications of this commit by David Gwynne (dlg@) carefully.

CVSROOT:	/cvs
Module name:	src
Changes by:	dlg@cvs.openbsd.org	2021/01/31 17:31:05

Modified files:
	sbin/pfctl     : parse.y pfctl_parser.c 
	share/man/man5 : pf.conf.5 
	sys/net        : if_pfsync.c pf.c pfvar.h 

Log message:
change route-to so it sends packets to IPs instead of interfaces.

this is a significant (and breaking) reworking of the policy based
routing that pf can do. the intention is to make it as easy as
nat/rdr to use, and more robust when it's operating.

This change is intended to make configuration and maintenance easier, but it runs a high risk of breaking existing configurations. Read on for the rest of David's commit message, with some background.

the main reasons for this change are:

- route-to, reply-to, and dup-to do not work with pfsync

this is because the information about where to route-to is stored in
rules, and it is hard to have a ruleset synced between firewalls,
and impossible to have them synced 100% of the time.

- i can make my boxes panic in certain situations using route-to

yeah...

- the configuration and syntax for route-to rules are confusing.

the argument to route-to and co is an interace name with an optional
ip address. there are several problems with this. one is that people
tend to think about routing as sending packets to peers by their
address, not by the interface they're reachable on. another is that
we currently have no way to synchronise interface topology information
between firewalls, so using an interface to say where packets go
means we can't do failover of these states with pfsync. another
is that a change in routing topology means a host may become
reachable over a different interface. tying routing policy to
interfaces gets in the way of failover and load balancing.

this change does the following:

- stores the route info in the state instead of the pf rule

this allows route-to to keep working when the ruleset changes, and
allows route-to info to be sent over pfsync. there's enough spare bits
in pfsync messages that the protocol doesnt break.

the caveat is that route-to becomes tied to pass rules that create
state, like rdr-to and nat-to.

- the argument to route-to etc is a destination ip address

it's not limited to a next-hop address (thought a next-hop can be a
destination address). this allows for the failover and load balancing
referred to above.

- deprecates the address@interface host syntax in pfctl

because routing is done entirely by IPs, the interface is derived from
the route lookup, not pf. any attempt to use the @interface syntax
will fail now in all contexts.

there's enthusiasm from proctor@ jmatthew@ and others
ok sashan@ bluhm@

Also see the entry for this change on the Following -current FAQ.

(Comments are closed)


Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]