From owner-freebsd-questions Tue Dec 4 2: 3:43 2001 Delivered-To: freebsd-questions@freebsd.org Received: from harrier.prod.itd.earthlink.net (harrier.mail.pas.earthlink.net [207.217.120.12]) by hub.freebsd.org (Postfix) with ESMTP id 40EB737B416 for ; Tue, 4 Dec 2001 02:03:41 -0800 (PST) Received: from dialup-209.245.134.132.dial1.sanjose1.level3.net ([209.245.134.132] helo=blossom.cjclark.org) by harrier.prod.itd.earthlink.net with esmtp (Exim 3.33 #1) id 16BCQO-0001er-00; Tue, 04 Dec 2001 02:03:40 -0800 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.3) id fB4A3Ur38658; Tue, 4 Dec 2001 02:03:30 -0800 (PST) (envelope-from cjc) Date: Tue, 4 Dec 2001 02:03:30 -0800 From: "Crist J . Clark" To: Sheldon Hearn Cc: freebsd-questions@FreeBSD.ORG Subject: Re: ipnat & ipfirewall ordering Message-ID: <20011204020330.F37981@blossom.cjclark.org> References: <13427.1007453916@axl.seasidesoftware.co.za> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <13427.1007453916@axl.seasidesoftware.co.za>; from sheldonh@starjuice.net on Tue, Dec 04, 2001 at 10:18:36AM +0200 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Tue, Dec 04, 2001 at 10:18:36AM +0200, Sheldon Hearn wrote: > > Hi folks, > > I'm migrating a firewall from natd to ipnat. > > I would like to continue using ipfirewall for packet filtering at this > stage. Baby steps. > > It looks to me like the order in which things happen is: > > ipfilter (Allow all) > ipnat (1:1 bimaps) > ipfirewall (Actual packet filtering) Close, it's actually, ipnat ipf ipfw in ---------------------------------> <--------------------------------- out > This means that I need to change all my ipfirewall rules to use the nat'd > (private) addresses of protected hosts, rather than the real (public) > addresses as I did things before. Yep. > Am I correct about the order in which things are happening? Do I really > need to change all my ipfirewall rules, or is there a trick to having > ipfirewall processing done _before_ ipnat processing? Nope. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message