From owner-freebsd-questions@FreeBSD.ORG Fri Apr 9 15:07:36 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id ABB991065673 for ; Fri, 9 Apr 2010 15:07:36 +0000 (UTC) (envelope-from smithi@nimnet.asn.au) Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [115.70.110.159]) by mx1.freebsd.org (Postfix) with ESMTP id 05F738FC13 for ; Fri, 9 Apr 2010 15:07:35 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id o39F7XlG006499; Sat, 10 Apr 2010 01:07:34 +1000 (EST) (envelope-from smithi@nimnet.asn.au) Date: Sat, 10 Apr 2010 01:07:32 +1000 (EST) From: Ian Smith To: Robert Huff In-Reply-To: <19391.7909.888110.689450@jerusalem.litteratus.org> Message-ID: <20100409233244.F52200@sola.nimnet.asn.au> References: <20100408234803.7519B1065770@hub.freebsd.org> <20100409160704.K52200@sola.nimnet.asn.au> <19391.7909.888110.689450@jerusalem.litteratus.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: Adam Vande More , freebsd-questions@freebsd.org Subject: Re: Kernel Config for NAT X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Apr 2010 15:07:36 -0000 On Fri, 9 Apr 2010, Robert Huff wrote: > Ian Smith writes: > > > > So ... double-checking I'm doing this right: > > > > > > 1) in /boot/loader.conf: > > > > > > ipfw_load="YES" > > > ipdivert_load="YES" > > > > I thought from your earlier mail that you wanted to use in-kernel > > NAT? > > I want whatever works. :-) natd works, as ever. ipfw nat is reputed to work faster. > Beyond that ... all other things being more-or-less equal I'll > do this with modules. > Let's build that. So in /etc/sysctl.conf: > > net.inet.ip.fw.default_to_accept="1" > net.inet.ip.fw.verbose="1" > net.inet.ip.fw.verbose_limit="100" > > check. > > > I believe all these can be accomplished with modules on GENERIC > > kernel, at least on 8.x, with the exception of FIREWALL_FORWARD > > functionality which does require a custom kernel as it messes > > with lots of ip paths. > > This machine has a custom kernel, so that's not a an issue. > And in /boot/loader.conf: > > ipfw_load="YES" > ipfw_nat="YES" # in-kernel ipfw nat > libalias="YES" # for in-kernel ipfw nat ipfw_nat_load="YES" libalias_load="YES" > check. > and in the kernel config: > > #options IPFIREWALL #firewall > #options IPFIREWALL_VERBOSE #enable logging to syslogd(8) > > options IPFIREWALL_FORWARD Planning on using any 'fwd' rules? > #options IPFIREWALL_VERBOSE_LIMIT=100 #limit verbosity > #options IPFIREWALL_DEFAULT_TO_ACCEPT #allow everything by default > #options IPDIVERT > #options IPFIREWALL_NAT #ipfw kernel nat support > #options LIBALIAS # required for NAT > > check. > This combination will get me a) ipfw, using the standard > rc.conf "firewall_" variables, and b) NAT ... do I still need to > have a "nat" setting in the firewall rules? The 'client' ruleset now has rules for either natd or ipfw nat. The 'simple' ruleset works with natd (from natd_enable and natd_interface in rc.conf), but still lacks the patch for ipfw nat - my remiss for seeking comment in ipfw@ rather than sending it with a PR, as one should. Time I redid it, you can be guinea pig :) What freebsd version? cheers, Ian