From owner-freebsd-security@FreeBSD.ORG  Wed Jun 11 03:05:05 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6A9CC37B404
	for <freebsd-security@freebsd.org>;
	Wed, 11 Jun 2003 03:05:05 -0700 (PDT)
Received: from highland.isltd.insignia.com (highland.isltd.insignia.com
	[195.74.141.1])	by mx1.FreeBSD.org (Postfix) with ESMTP id 0D5AB43FB1
	for <freebsd-security@freebsd.org>;
	Wed, 11 Jun 2003 03:05:04 -0700 (PDT)
	(envelope-from subscriber@insignia.com)
Received: from dailuaine.isltd.insignia.com (dailuaine.isltd.insignia.com
	[172.16.64.11])h5BA52Ef033422	for <freebsd-security@freebsd.org>;
	Wed, 11 Jun 2003 11:05:02 +0100 (BST)
	(envelope-from subscriber@insignia.com)
Received: from exchange-uk.isltd.insignia.com (exchange-uk [172.16.64.9])
	h5BA52D0043037	for <freebsd-security@freebsd.org>;
	Wed, 11 Jun 2003 11:05:02 +0100 (BST)
	(envelope-from subscriber@insignia.com)
Received: by exchange-uk.isltd.insignia.com with Internet Mail Service
	(5.5.2653.19)	id <MQ7V1H01>; Wed, 11 Jun 2003 11:05:02 +0100
Message-ID: <2F03DF3DDE57D411AFF4009027B8C36704129AE8@exchange-uk.isltd.insignia.com>
From: Subscriber <subscriber@insignia.com>
To: freebsd-security@freebsd.org
Date: Wed, 11 Jun 2003 11:05:00 +0100
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
X-Scanned-By: MIMEDefang 2.32 (www . roaringpenguin . com / mimedefang)
Subject: IPFW: combining "divert natd" with "keep-state"
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 11 Jun 2003 10:05:06 -0000

I've been using ipfw for a while to create a router with NAT
and packet filtering, but have never combined it with
stateful filtering, instead using things like "established" to
accept incoming TCP packets which are part of a conversation
initiated from the "inside".

I'd like to move to using keep-state/check-state to get tighter
filtering and also to allow outgoing UDP and the replies, which
currently I block.

But I just can't get my head around how to do this. On the way
out, should the dynamic rules be created to match the pre-NAT
or post-NAT packets?

The man pages are good at explaining both NAT and dynamic
rules but not both in combination.

Jim Hatfield