From owner-FreeBSD-net-jp@jp.freebsd.org  Mon Mar 26 21:47:44 2001
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id VAA30816;
	Mon, 26 Mar 2001 21:47:44 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from mx.yaya.forks.co.jp (51.96.149.210.economy.2iij.net [210.149.96.51])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id VAA30811
	for <FreeBSD-net-jp@jp.freebsd.org>; Mon, 26 Mar 2001 21:47:42 +0900 (JST)
	(envelope-from marina@yaya.forks.co.jp)
Received: by mx.yaya.forks.co.jp (8.9.3/3.7W-2.8compat.base) id VAA98896; Mon, 26 Mar 2001 21:47:41 +0900 (JST)
Date: Mon, 26 Mar 2001 21:47:41 +0900
From: Masanori Takeishi <marina@yaya.forks.co.jp>
To: FreeBSD-net-jp ML <FreeBSD-net-jp@jp.freebsd.org>
Message-Id: <20010326210816.0F72.MARINA@yaya.forks.co.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-2022-JP"
Content-Transfer-Encoding: 7bit
X-Mailer: Becky! ver. 2.00.01
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+000315
X-Sequence: FreeBSD-net-jp 3034
Subject: [FreeBSD-net-jp 3034] about a PPPoE(ADSL)+nat problem
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org
X-Originator: marina@yaya.forks.co.jp

$BIp@P$H?=$7$^$9!#(B

$B<+Bp$r%U%l%C%D!&(BISDN$B$+$i%U%l%C%D!&(BADSL$B$KJQ99$7$F$^$+$i0l7n0J>e7P2a$7!"(B
$BLdBjL5$/;H$($F$$$k$H;W$C$F$$$?$N$G$9$,!"(Bnat$B7PM3$G%"%/%;%9$9$k$H8+$l$J$$(B
$B%5%$%H$,4v$D$+B8:_$9$k;v$K5$$,IU$-$^$7$?!#(BISDN$B$N;~$O8+$($F$$$?$H;W$$$^$9(B

$B<+J,$J$j$KD4$Y$F$_$?$N$G$9$,!"2r7h:v$,;W$$$D$-$^$;$s!#(B
$B%"%I%P%$%9$r$*4j$$CW$7$^$9!#(B

$B>u67!&$d$C$?;v$J$I!J$A$g$C$HD9J8!K(B
FreeBSD 4.2R(NETGRAPH,NETGRAPH_ETHER,NETGRAPH_PPPOE,NETGRAPH_SOCKET)
PPPoE

NG case ($B<+Bp(BADSL)
win98 --> ppp-nat(PPPoE) --> internet --> member.nifty.ne.jp
        dc0            ed0

nat$BFb$K$"$k%/%i%$%"%s%H(BWin98$B$N%V%i%&%6$G(Bmember.nifty.ne.jp$B$r8+$k$H(B
$B%5!<%P$+$i$N1~Ez$rBT$C$F$$$^$9$N>uBV$K$J$j$=$N$^$^(B

$B$=$N;~$N(Btcpdump
su-2.04# tcpdump -i tun0 host member.nifty.ne.jp
06:10:13.780598 tp535.marina.home.2594 > member.nifty.ne.jp.http: S 123341200:12
3341200(0) win 8192 <mss 1460,nop,nop,sackOK> (DF)
06:10:13.827022 member.nifty.ne.jp.http > tp535.marina.home.2594: S 2511647840:2
511647840(0) ack 123341201 win 8760 <mss 1460> (DF)
06:10:13.827546 tp535.marina.home.2594 > member.nifty.ne.jp.http: . ack 1 win 87
60 (DF)
06:10:13.829509 tp535.marina.home.2594 > member.nifty.ne.jp.http: P 1:327(326) a
ck 1 win 8760 (DF)
06:10:13.881932 member.nifty.ne.jp.http > tp535.marina.home.2594: . ack 327 win
8760 (DF)
06:10:13.907030 member.nifty.ne.jp.http > tp535.marina.home.2594: P 1:228(227) a
ck 327 win 8760 (DF)
06:10:14.107273 tp535.marina.home.2594 > member.nifty.ne.jp.http: . ack 228 win
8533 (DF)
06:10:14.166130 member.nifty.ne.jp.http > tp535.marina.home.2594: F 1688:2481(79
3) ack 327 win 8760 (DF)
06:10:14.167784 tp535.marina.home.2594 > member.nifty.ne.jp.http: . ack 228 win
8533 (DF)
$B"((Btp535$B$O%/%i%$%"%s%H$N(Bwin98$B%^%7%sL>(B

$B44@~$NLdBj$+$H;W$$!"(BFreeBSD$B%^%7%s$+$i!"(Btelnet $B$G%"%/%;%9$7$F$_$^$7$?!#(B
$B!J$3$l$O@5>o!K(B
telnet member.nifty.ne.jp 80 ( GET / )

su-2.04# tcpdump -i tun0 host member.nifty.ne.jp
tcpdump: listening on tun0
06:08:50.393627 PPP.xxxxx.dti.ne.jp.1170 > member.nifty.ne.jp.http: S 28840
71975:2884071975(0) win 16384 <mss 1414> (DF) [tos 0x10]
06:08:50.439104 member.nifty.ne.jp.http > PPP.xxxxx.dti.ne.jp.1170: S 14576
12492:1457612492(0) ack 2884071976 win 9898 <mss 1414> (DF)
06:08:50.439183 PPP.xxxxx.dti.ne.jp.1170 > member.nifty.ne.jp.http: . ack 1
 win 16968 (DF) [tos 0x10]
06:08:53.241682 PPP.xxxxx.dti.ne.jp.1170 > member.nifty.ne.jp.http: P 1:8(7
) ack 1 win 16968 (DF) [tos 0x10]
06:08:53.288946 member.nifty.ne.jp.http > PPP.xxxxx.dti.ne.jp.1170: . ack 8
 win 9898 (DF)
06:08:53.311303 member.nifty.ne.jp.http > PPP.xxxxx.dti.ne.jp.1170: P 1:141
5(1414) ack 8 win 9898 (DF)
06:08:53.410642 PPP.xxxxx.dti.ne.jp.1170 > member.nifty.ne.jp.http: . ack 1
415 win 16968 (DF) [tos 0x10]
06:08:53.470125 member.nifty.ne.jp.http > PPP.xxxxx.dti.ne.jp.1170: FP 1415
:2479(1064) ack 8 win 9898 (DF)
06:08:53.470219 PPP.xxxxx.dti.ne.jp.1170 > member.nifty.ne.jp.http: . ack 2
480 win 15904 (DF) [tos 0x10]
06:08:53.472597 PPP.xxxxx.dti.ne.jp.1170 > member.nifty.ne.jp.http: F 8:8(0
) ack 2480 win 16968 (DF) [tos 0x10]
06:08:53.521640 member.nifty.ne.jp.http > PPP.xxxxx.dti.ne.jp.1170: . ack 9
 win 9898 (DF)
$B"((BPPP.xxxxx.dti.ne.jp$B$O%W%m%P%$%@$+$i<hF@$7$?%0%m!<%P%k%"%I%l%9!#(B

nat$B7PM3$@$H%"%/%;%9$G$-$J$$$_$?$$$J$N$G(B
win98 --> squid+ppp(PPPoE) --> internet --> member.nifty.ne.jp
$B$K$7$F$_$?$i!"LdBjL5$/1\Mw$G$-$^$7$?!#(B

ADSL$B$O(Bnat$B$@$HLdBj$"$k%5%$%H$,$"$k!)!)(B
$B2q<R$N(BADSL$B!J4D6-$O<c43$A$,$$$^$9$,!&!K$G;n$7$F$_$^$7$?!#(B

OK case ($B2q<R(BSDSL)
win98 --> IPFilter+NATD --> router --> internet --> member.nifty.ne.jp
       fxp0           ed0

su-2.04# tcpdump -i ed0 host member.nifty.ne.jp
20:19:48.858669 sdsl.xxx.co.jp.1051 > member.nifty.ne.jp.http: S
4481610:4481610(
0) win 8192 <mss 1460,nop,nop,sackOK> (DF)
20:19:48.866999 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1051: S 3929065735:39290
65735(0) ack 4481611 win 8760 <mss 1460> (DF)
20:19:48.867612 sdsl.xxx.co.jp.1051 > member.nifty.ne.jp.http: . ack 1 win 8760 (
DF)
20:19:48.886473 sdsl.xxx.co.jp.1051 > member.nifty.ne.jp.http: P 1:300(299) ack 1
 win 8760 (DF)
20:19:48.896705 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1051: . ack 300 win 8760
 (DF)
20:19:48.915619 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1051: P 1:228(227) ack 3
00 win 8760 (DF)
20:19:49.051653 sdsl.xxx.co.jp.1051 > member.nifty.ne.jp.http: . ack 228 win 8533
 (DF)
20:19:49.070175 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1051: . 228:1688(1460) a
ck 300 win 8760 (DF)
20:19:49.077951 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1051: . 1688:3148(1460)
ack 300 win 8760 (DF)
20:19:49.124286 sdsl.xxx.co.jp.1051 > member.nifty.ne.jp.http: . ack 3148 win 876
0 (DF)
20:19:49.143308 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1051: . 3148:4608(1460)
ack 300 win 8760 (DF)
20:19:49.151188 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1051: . 4608:6068(1460)
ack 300 win 8760 (DF)
20:19:49.153387 sdsl.xxx.co.jp.1051 > member.nifty.ne.jp.http: . ack 6068 win 876
0 (DF)
20:19:49.157586 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1051: F 6068:7324(1256)
ack 300 win 8760 (DF)
20:19:49.211894 sdsl.xxx.co.jp.1051 > member.nifty.ne.jp.http: . ack 7325 win 750
4 (DF)
20:19:49.257630 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: S
4482004:4482004(
0) win 8192 <mss 1460,nop,nop,sackOK> (DF)
20:19:49.265818 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: S 4164926434:41649
26434(0) ack 4482005 win 8760 <mss 1460> (DF)
20:19:49.266423 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 1 win 8760 (
DF)
20:19:49.285164 sdsl.xxx.co.jp.1051 > member.nifty.ne.jp.http: F 300:300(0) ack 7
325 win 7504 (DF)
20:19:49.289818 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: P 1:327(326) ack 1
 win 8760 (DF)
20:19:49.292975 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1051: . ack 301 win 8760
 (DF)
20:19:49.299827 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . ack 327 win 8760
 (DF)
20:19:49.308170 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 1:230(229) ack 3
27 win 8760 (DF)
20:19:49.456828 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 230 win 8531
 (DF)
20:19:49.476494 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 230:1690(1460) a
ck 327 win 8760 (DF)
20:19:49.484220 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 1690:3150(1460)
ack 327 win 8760 (DF)
20:19:49.486137 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 3150 win 876
0 (DF)
20:19:49.505130 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 3150:4610(1460)
ack 327 win 8760 (DF)
20:19:49.512857 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 4610:6070(1460)
ack 327 win 8760 (DF)
20:19:49.514771 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 6070 win 876
0 (DF)
20:19:49.520644 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 6070:7530(1460)
ack 327 win 8760 (DF)
20:19:49.534081 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 7530:8990(1460)
ack 327 win 8760 (DF)
20:19:49.536109 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 8990 win 876
0 (DF)
20:19:49.541873 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 8990:10450(1460)
 ack 327 win 8760 (DF)
20:19:49.549557 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 10450:11910(1460
) ack 327 win 8760 (DF)
20:19:49.551501 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 11910 win 87
60 (DF)
20:19:49.557448 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 11910:13370(1460
) ack 327 win 8760 (DF)
20:19:49.565137 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 13370:14830(1460
) ack 327 win 8760 (DF)
20:19:49.567137 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 14830 win 87
60 (DF)
20:19:49.572975 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 14830:16290(1460
) ack 327 win 8760 (DF)
20:19:49.580804 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 16290:17750(1460
) ack 327 win 8760 (DF)
20:19:49.582833 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 17750 win 87
60 (DF)
20:19:49.588553 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 17750:19210(1460
) ack 327 win 8760 (DF)
20:19:49.596230 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 19210:20670(1460
) ack 327 win 8760 (DF)
20:19:49.598161 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 20670 win 87
60 (DF)
20:19:49.604095 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 20670:22130(1460
) ack 327 win 8760 (DF)
20:19:49.611852 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 22130:23590(1460
) ack 327 win 8760 (DF)
20:19:49.613850 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 23590 win 87
60 (DF)
20:19:49.619585 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 23590:25050(1460
) ack 327 win 8760 (DF)
20:19:49.627389 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 25050:26510(1460
) ack 327 win 8760 (DF)
20:19:49.629386 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 26510 win 87
60 (DF)
20:19:49.635189 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 26510:27970(1460
) ack 327 win 8760 (DF)
20:19:49.643031 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 27970:29430(1460
) ack 327 win 8760 (DF)
20:19:49.650755 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 29430:30890(1460
) ack 327 win 8760 (DF)
20:19:49.658584 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 30890:32350(1460
) ack 327 win 8760 (DF)
20:19:49.666221 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . 32350:33810(1460
) ack 327 win 8760 (DF)
20:19:49.674097 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: P 33810:35270(1460
) ack 327 win 8760 (DF)
20:19:49.706715 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 30890 win 87
60 (DF)
20:19:49.706866 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 35270 win 43
80 (DF)
20:19:49.715492 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: FP 35270:35402(132
) ack 327 win 8760 (DF)
20:19:49.716308 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 35403 win 42
48 (DF)
20:19:49.792432 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 35403 win 57
08 (DF)
20:19:49.796489 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: . ack 35403 win 87
60 (DF)
20:19:49.813319 sdsl.xxx.co.jp.1052 > member.nifty.ne.jp.http: F 327:327(0) ack 3
5403 win 8760 (DF)
20:19:49.820627 member.nifty.ne.jp.http > sdsl.xxx.co.jp.1052: . ack 328 win 8760
 (DF)
$B"(%/%i%$%"%s%H%^%7%s$OF1$8(Bwin98
$B"((Bsdsl.xxx.co.jp$B$O%0%m!<%P%k%"%I%l%9(B

$B$3$3$GBg$-$J0c$$$K5$$,IU$-$^$7$?!#(B
$B<+Bp$N(Btcpdump$B$O%/%i%$%"%s%H%^%7%s$N(BIP$B$J$N$K(B
$B2q<R$G$N(Btcpdump$B$O%0%m!<%P%k(BIP$B$G$9!#(B

ADSL$B0J30$N(Btun0$B$N(Btcpdump$B$,<h$l$J$$$N$G!"Hf3S$G$-$J$$$N$G$9$,!"$=$NJU$j$,(B
$BLdBj$J$N$G$7$g$&$+!)(B
$B<+Bp$r(BIPFilter+natd(dc0 - tun0)$B$K$9$l$P2r7h$9$k$N$+$b$7$l$^$;$s$,(B
ppp$B$G=PMh$J$$$b$N$+$H!&!&!&!&(B

$BD9J8?=$7Lu$"$j$^$;$s$,!"$*CN7C$r!&!&!&(B

