From owner-freebsd-questions@FreeBSD.ORG Fri Nov 24 06:50:41 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 3068116A412 for ; Fri, 24 Nov 2006 06:50:41 +0000 (UTC) (envelope-from frank@esperance-linux.co.uk) Received: from mailout.zetnet.co.uk (mailout.zetnet.co.uk [194.247.47.231]) by mx1.FreeBSD.org (Postfix) with ESMTP id EB0AE43D55 for ; Fri, 24 Nov 2006 06:50:00 +0000 (GMT) (envelope-from frank@esperance-linux.co.uk) Received: from irwell.zetnet.co.uk ([194.247.47.48] helo=zetnet.co.uk) by mailout.zetnet.co.uk with esmtp (Exim 4.50) id 1GnUtS-00023v-Ro for freebsd-questions@freebsd.org; Fri, 24 Nov 2006 06:50:38 +0000 Received: from esperance.zetnet.co.uk (54-144.adsl.zetnet.co.uk [194.247.54.144]) by zetnet.co.uk (8.13.8/8.13.8/Debian-2) with SMTP id kAO6ocmE003588 for ; Fri, 24 Nov 2006 06:50:38 GMT Received: (qmail 9072 invoked by uid 1001); 24 Nov 2006 06:50:32 -0000 From: "Frank Shute" Date: Fri, 24 Nov 2006 06:50:32 +0000 To: Nilton Volpato Message-ID: <20061124065032.GA9023@melon.esperance-linux.co.uk> References: <27fef5640611171328r2973167dm2b58e1dc2e393bb7@mail.gmail.com> <27fef5640611181512p335c0900la2125c7110156dac@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <27fef5640611181512p335c0900la2125c7110156dac@mail.gmail.com> User-Agent: Mutt/1.4.2.2i X-Operating-System: FreeBSD 6.2-RC1 i386 X-Organisation: 'Esperance Linux' X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2 (zetnet.co.uk [194.247.46.1]); Fri, 24 Nov 2006 06:50:38 +0000 (GMT) Cc: freebsd-questions@freebsd.org Subject: Re: port redirection with natd and ipfw X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Frank Shute List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Nov 2006 06:50:41 -0000 On Sat, Nov 18, 2006 at 09:12:30PM -0200, Nilton Volpato wrote: > > Hi, > > I'm using a computer with FreeBSD as a gateway and NAT for a private > LAN. Let's say the gateway has external.com as external address, and > 192.168.0.1 as internal address, so that the LAN is 192.168.0.0/24. > > I'm doing a number of port redirects in the gateway, for svn, http, > https, ssh, etc using natd. However, these port redirects do not work > from inside the LAN. > > For instance, if I point my browser to http://external.com and I'm in > the LAN, then it will not work. I can't use the internal address of > the web server because none of the links will work on the web page. > > In summary, I want that my port redirections work also when I try to > connect to the gateway's external address from inside the LAN. > > I'm using a minimal ipfw configuration to try to solve this. This is > the default configuration. > > 00050 divert 8668 ip4 from any to any via vr0 > 00100 allow ip from any to any via lo0 > 00200 deny ip from any to 127.0.0.0/8 > 00300 deny ip from 127.0.0.0/8 to any > 65000 allow ip from any to any > 65535 deny ip from any to any > > I tried to add: > > 00060 divert 8668 ip4 from 192.168.0.0/24 to external.com > > expecting that it would send the packets from LAN to natd, which would > apply the port redirections. But it did not work. > > How can I solve this? > > Thanks, > -- Nilton What I do in these circumstances is put a line in /etc/hosts on the machines on the LAN eg: 192.168.0.1 external.com If you've got a standard host.conf then it gets picked up before bind. Whilst it means you don't connect to the external interface of external.com it has the same effect and you can browse your site etc. No fancy firewall rules required either. HTH. -- Frank echo "f r a n k @ e s p e r a n c e - l i n u x . c o . u k" | sed 's/ //g' --->PGP keyID: 0x10BD6F4B<---