From owner-freebsd-questions@FreeBSD.ORG Sun Jun 1 17:50:32 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CBB2D37B401 for ; Sun, 1 Jun 2003 17:50:32 -0700 (PDT) Received: from shiba.meibin.net (shiba.meibin.net [219.166.101.122]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4475443FAF for ; Sun, 1 Jun 2003 17:50:31 -0700 (PDT) (envelope-from lukek@meibin.net) Received: (qmail 91705 invoked from network); 2 Jun 2003 00:50:16 -0000 Received: from unknown (HELO yujo) (219.114.104.9) by shiba.meibin.net with SMTP; 2 Jun 2003 00:50:16 -0000 Message-ID: <002301c328a0$9bb49f50$6501a8c0@yujo> From: "lukek" To: "FreeBSD" Date: Mon, 2 Jun 2003 09:47:56 +0900 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Subject: IPFilter and PPTP X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Jun 2003 00:50:33 -0000 Hi, I have a small question relating to IPFilter. I have started using this on my firewall and the users need to establish PPTP connections to a different office to collect their mail and use certain applications remotely. I have managed to get it working on a one to one mapping basis but the concept I am aiming for is dynamic NAT of all the private addresses in to one single address but this requires some fancy rules that I cannot get worked out. The network looks something like this TUN0 a.b.c.d/29 ___|_________ |FBSD |rl1 |____________|------ wireless segment 10.0.0.2/24 |rl2 | ethernet segment 10.0.0.5/24 Now each of the internal interfaces use DHCP to assign addresses to client and I want to map each internal interface to an external IP ie rdr tun0 a.b.c.d/32 -> 10.0.0.5/24 rdr tun0 a.b.c.e/32 -> 10.0.0.2/24 The remote VPN server appears to be a MS box. I would prefer not to use static IP assignments as whilst there are only a couple of users now there are more on their way and dynamic is the way I would prefer to manage this in the long run. Any advice people can offer would be really appreciated. Cheers LukeK