[stunnel-users] Stunnel forwarding IP (transparent proxy on FreeBSD)

oscaruser at programmer.net oscaruser at programmer.net
Tue Jan 4 19:30:51 CET 2011


Not wanting to sound like the voice in the wilderness... but there is now a FreeBSD 8.x patch for stunnel to utilize the IP_BINDANY setsockopt. It does not work fully, only partly. The partly being the traffic looks like it's coming from the external IP address to the internal service, but the service cannot talk back on this IP address either because of network routing or because the kernel does not recognize the instruction to speak to the foreign address via proxy.


After testing numerous pf rules, I've come to the conclusion pf cannot produce the result. 

ext_if="ed0"  # 192.168.103.x

ext2_if="ed1" #

rdr pass log inet proto tcp from to $int_if port 80 -> $int_if
nat pass log inet proto tcp from to $int_if port 80 -> $int_if


pass in log on $ext_if reply-to ($ext2_if from synproxy state

Neither of these methods rules work, but the first actually rewrites the source IP to the internal IP, thereby undoing the proxy function. The second creates a connection, but thus synchronizing the connection at pf, but actual network traffic is listed via tcpdump. 

Another project seems to accomplish this goal via ipfw 'fwd' rules (IPFIREWALL_FORWARD). 

# ipfw add 100 fwd,10025 tcp from not me to any 25


-----Original Message-----
From: oscaruser at programmer.net
To: stunnel-users at mirt.net
Sent: Wed, Dec 29, 2010 4:18 pm
Subject: Re: [stunnel-users] Stunnel forwarding IP

[second sending of the same message]

OK I see transparent configuration option, but looks only available for Linux. Tried on FreeBSD 7.3 amd64 and FBSD 8.1 amd64, with same result, "local_bind (original port): Can't assign requested address (49)". Apparently v8.1 supports IP_BINDANY (man ip 8), but stunnel may not be using this feature (based on searching the stunnel-4.33 source code).

-----Original Message-----
From: oscaruser at programmer.net
To: stunnel-users at mirt.net
Sent: Wed, Dec 29, 2010 2:07 pm
Subject: [stunnel-users] Stunnel forwarding IP


For my server daemon process, I am accepting incoming requests only from pre-seeded IP addrs. Using Stunnel, I am finding connecting IPs are '' or localhost. Is there any configuration or solution to represent incoming IPs for the given file descriptor belonging to their originating IP addrs?

Thank you.


stunnel-users mailing list
stunnel-users at mirt.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.stunnel.org/pipermail/stunnel-users/attachments/20110104/96322e1b/attachment.html>

More information about the stunnel-users mailing list