Date: Tue, 3 Apr 2012 15:23:59 -0400 From: Michael MacLeod <mikemacleod@gmail.com> To: freebsd-pf@freebsd.org Subject: PF And Cone NAT Message-ID: <CAM-FeoENCu2dxCJM6GAY-SRaGh9Qvaik5OrhgjBNRT1Nbjx45w@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Ladies and Gentlemen, Every once and a while I run into an issue wherein the symmetric NAT of pf causes me grief. I've found some older mailing list entries asking about PF and Cone or Full Cone NAT (such as this one from 2005: http://www.mail-archive.com/freebsd-pf@freebsd.org/msg00804.html), but I haven't seen anything new in a while. Almost all discussion I can find suggests to use static-port on the NAT rule entry, but this doesn't seem to be entirely the same thing. Adding static-port will prevent PF from randomizing the source port used for outbound TCP and UDP traffic, but I don't see any mention of it enabling actual Cone behaviour with regards to inbound traffic destined for the now-not-random port. It appears that a NAT table entry, even with the static-port option, will still not accept an inbound packet from external IP B when the NAT rule was originally created for external IP A, which I gather is the main thrust of cone NAT. I understand that cone NAT is a generally terrible and insecure way to do NAT, but game and application developers seem hell-bent on depending on cone NAT behaviour. Is there a way to make it work with PF? Regards, Mike
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAM-FeoENCu2dxCJM6GAY-SRaGh9Qvaik5OrhgjBNRT1Nbjx45w>