Date: Sat, 10 Mar 2012 16:02:13 +0100 From: "Terrence Koeman" <terrence@mediamonks.net> To: "freebsd-ipfw@freebsd.org" <freebsd-ipfw@freebsd.org> Cc: "freebsd-ipfw@herveybayaustralia.com.au" <freebsd-ipfw@herveybayaustralia.com.au> Subject: RE: newbie IPFW user Message-ID: <df0f6476d5fe3d4faa49fa884bb4a7d6@mediamonks.com> In-Reply-To: <4F5B5187.2010303@herveybayaustralia.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Sat, 10 Mar 2012 at 14:05:11, Da Rock wrote: > On 03/10/12 19:47, Julian Elischer wrote: >> On 3/9/12 6:39 AM, Da Rock wrote: >>> I'm relatively new to IPFW, not FBSD; the last time I used IPFW (I >>> believe) was using 4.3. I'm now attempting to use IPFW for some tests >>> (and hopefully move to production), and I'm trying to determine how I >>> would setup binat using IPFW; or even if its possible at all. >>> >>> I've been hunting some more in depth documentation, but it appears to >>> be scarce/not definitive. I suspect using the modes in libalias such >>> as "use same ports" and "reverse" might be able to do what I'm looking >>> for? >>> >>> Any clarity much appreciated. >> >> well of course >> man ipfw is the basis.. >> >> since you don't give any hints as to what you want to do that is not >> in /etc/rc.firewall, >> it is hard to know how to help you.. > I think that is the fundamental problem: I defined what I was doing but > the terms are foreign, ergo the man doesn't show it either. > > Binat is defined in pf, so I used the terminology thinking it would just > click. Apparently not :) Binat is 1:1 natting to and from a client > behind a firewall (according to pf), so binat nats traffic from the > client and from the external network. For all intents and purposes it > appears the client is actually on the external network, with the added > benefit that only the ports needed can be natted, and others can be > diverted elsewhere. > > I'm using it for voip currently (and vpn on the same client): voip > requires 5060 remote _and_ connection ports, and needs to be forwarded > as is (excepting ip address) and not appear to be natted os as not to > confuse the client. VPN uses 500/4500 and requires an untouched packet > payload (ipsec). > > Are there any sources for documentation on the advanced uses of ipfw? I > stumbled on just one that goes into more detail so far > http://www.freebsd-howto.com/HOWTO/Ipfw-HOWTO. You are describing static NAT I believe. I use: $cmd nat 10 config ip <external IP1> same_ports \ redirect_addr 172.16.10.101 <external IP2> \ redirect_addr 172.16.0.75 <external IP3> Also look at redirect_port. -- Regards, T. Koeman, MTh/BSc/BPsy; Technical Monk MediaMonks B.V. (www.mediamonks.com) Please quote relevant replies in correspondence. [-- Attachment #2 --] 0 *H 01 0 + 0 *H 00E.3]+*c:=sRgy0 *H 01 0 UUS1 0 U www.xrampsecurity.com1$0"U XRamp Security Services Inc1-0+U$XRamp Global Certification Authority0 110716140129Z 120716151657Z0w1 0 Uterrence@mediamonks.net10 Usmime1 0 UUS1&0$ *H terrence@mediamonks.net10 U smime00 *H 0 FN7S'}?(E\S\soI4#r}7!R&Sf}p]x)~׀R RtPD'˜θ*|2 3ln/K4Tju}-5t7 00 U 0 0 U 5: G F 10 U 0U % 0 +04U -0+0)'%#http://crl.securetrust.com/XGCA.crl0BU ;0907 `Hd0)0'+http://ssl.trustwave.com/CA0 *H }NB?WߙP̡I^/u|Ț*W'!0\oGY7I8 &k"#jW o5+ ZcL$0SˈџSXL8 Fh-`|?=,S]uLR+6P/ /eO/%SV=4'e"C ѧ7ܚ"B!F6Z#q5"d%νa3o ? bVv ߜ8a8V~p0000Pl՜Mu0 *H 01 0 UUS1 0 U www.xrampsecurity.com1$0"U XRamp Security Services Inc1-0+U$XRamp Global Certification Authority0 041101171404Z 350101053719Z01 0 UUS1 0 U www.xrampsecurity.com1$0"U XRamp Security Services Inc1-0+U$XRamp Global Certification Authority0"0 *H 0 $ nj'8 iN,.! \D!]~#t^~J [gtk])ٜ mv(XeJy1~+@;ˢ6`0mn3_OaZ ;k-4|Ha aDoJM4zr8A<}Ȧ3;=7z>,s WddZ%"4,h mӊ ď#z jBg%E!|b>-e 00 +7 C A0 U 0U 00 U O=c b\06U /0-0+)'%http://crl.xrampsecurity.com/XGCA.crl0 +70 *H 9gJ `[Mb$S'ׂdN.I+xg5 H ?ɶUHY.[;}G7_Mv6 סF ,m~?) ɒsd+ ,ҹ}o1 y\#M! My' dA1l$\q~ j!ۦ@=i(<|@C}:4 ;L'|Bt| ɴ%10001 0 UUS1 0 U www.xrampsecurity.com1$0"U XRamp Security Services Inc1-0+U$XRamp Global Certification AuthorityE.3]+*c:=sRgy0 + o0 *H 1 *H 0 *H 1 120310150212Z0# *H 1a:l`W97w10 +71001 0 UUS1 0 U www.xrampsecurity.com1$0"U XRamp Security Services Inc1-0+U$XRamp Global Certification AuthorityE.3]+*c:=sRgy0 *H 101 0 UUS1 0 U www.xrampsecurity.com1$0"U XRamp Security Services Inc1-0+U$XRamp Global Certification AuthorityE.3]+*c:=sRgy0 *H 100 `He*0 `He0 *H 0 `He0*H 0+0 *H @0 *H (0+0 `He0 `He0 `He0 *H 0 *H EO'(̜s8Aȗ$ /Xp%S'N iPh Pyܹ9%64 TRjŻÚy hNP- Xkdfj
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?df0f6476d5fe3d4faa49fa884bb4a7d6>