Date: Tue, 23 Aug 2011 13:42:08 +0300 From: Artyom Viklenko <artem@aws-net.org.ua> To: freebsd-pf@freebsd.org Subject: Re: problem with setting nat Message-ID: <4E538400.7050804@aws-net.org.ua> In-Reply-To: <alpine.BSF.2.00.1108231007580.67270@tiktik.epipe.com> References: <CAARSjE09vm3yvevBhhdK_6XrRpnKD5cwgnZJPVjVTsH=03JCsg@mail.gmail.com> <4E510AF8.9090009@gmx.de> <CAARSjE2uxqzqr97Y1w%2B0tf5B0ZaMFHTRXRMMCoWwjvfVz67_%2Bg@mail.gmail.com> <4E533FB4.5050403@gmx.de> <CAARSjE31vX4NW80nsHgaTBFD84YoOYL=shPY_3oUNkVBCvGxbA@mail.gmail.com> <4E5369DA.1030303@gmail.com> <alpine.BSF.2.00.1108231007580.67270@tiktik.epipe.com>
next in thread | previous in thread | raw e-mail | index | archive | help
23.08.2011 13:27, Janne Snabb пишет: > On Tue, 23 Aug 2011, Bartek W. aka Mastier wrote: > >> I completely don't see the point of using arp-proxy at all. >> Can you enlight me? > > I do not know about the particular needs of the OP. I have not been > paying attention. Sorry if I misunderstood something. > > But in real world: > > - The upstream router is often managed by the ISP and there might > be no way to put a static route towards the firewall in that router. In any case if you want to use some globally rotuable IPs for whatever purpose on your side, ISP already have to configure route for these IPs toward your (customer) router. Typically, this is exactly static route (which then distributed on ISP's backbone using OSPF or like). If you bild some intranet with nat on some places, there is no changes, but IP space. > - The available external IP block may be too small to allow subnetting > it to "outside of the firewall" and "inside of the firewall" networks. > This is becoming more and more of an issue as the IPv4 address space > has already run out but people have not migrated to IPv6. You can use small IP block on your internal LAN and use some of them on firewall itself not on "outside of the firewall". > - The IP addresses might have been previously assigned without thinking > that there will be a firewall in future. Then later it is decided that a > firewall is needed but it is not possible to renumber the IP addresses > of every host (due to lack of budget, skills, documentation, etc). Bridging firewall can solve this problem. > All of the above are very common situations in small to medium > businesses. Proxy ARP on the firewall solves all of them easily. > You just turn it on and everything works. If your ISP and moreover the world doesn't know how to reach ip v.x.y.z, proxy arp will not help at all. > (Please do not misunderstand me: I am not saying that it is an > elegant solution. However in many cases it is the only practical > solution.) > > -- > Janne Snabb / EPIPE Communications > snabb@epipe.com - http://epipe.com/ > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org" -- Sincerely yours, Artyom Viklenko. ------------------------------------------------------- artem@aws-net.org.ua | http://www.aws-net.org.ua/~artem artem@viklenko.net | JID: artem@jabber.aws-net.org.ua FreeBSD: The Power to Serve - http://www.freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4E538400.7050804>