Date: Wed, 17 Jul 2019 08:42:18 +0000 From: =?UTF-8?Q?Vin=C3=ADcius_Zavam?= <egypcio@googlemail.com> To: Yuri <yuri@rawbw.com> Cc: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org> Subject: Re: How to set up ipfw(8) NAT between an alias and the main IP address, when the alias is in another network? Message-ID: <CA%2BKr6DNdb-kMV10zgb61AZqoG=AOWMKnp1=bH9yhbtTHpUjnPw@mail.gmail.com> In-Reply-To: <8e388abc-f2ac-b070-cf86-a4d3971ac095@rawbw.com> References: <8e388abc-f2ac-b070-cf86-a4d3971ac095@rawbw.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Am Sa., 6. Juli 2019 um 08:02 Uhr schrieb Yuri <yuri@rawbw.com>: > My network interface looks like this: > > sk0: flags=3D8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 15= 00 > options=3D80009<RXCSUM,VLAN_MTU,LINKSTATE> > ether 01:3c:47:8a:17:12 > inet 192.168.1.2 netmask 0xffffff00 broadcast 192.168.1.255 > inet 192.168.100.2 netmask 0xffffffff broadcast 192.168.100.2 > media: Ethernet autoselect (100baseTX <full-duplex>) > status: active > nd6 options=3D29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL> > > The second IP address is an alias that is used for jail. > > I would like to set up NAT so that this jail would access the internet > through the same interface. > > > I tried this script: > > > fw=3D"/sbin/ipfw -q" > > $fw nat 1 config redirect_addr 192.168.100.2 192.168.1.2 redirect_addr > 192.168.1.2 192.168.100.2 if sk0 unreg_only reset > > $fw add 1001 nat 1 tcp from 192.168.100.2/32 to any via sk0 keep-state > > $fw add 1002 check-state > > > The rule 1001 has keep-state, therefore it should process both outgoing > tcp and incoming response packets. But the outbound packets are NATted, > but the inbound ones are not. > > What is wrong, and how to fix this script? > > > Thank you, > > Yuri > jail ... ip4=3Dinherit ? --=20 Vin=C3=ADcius Zavam keybase.io/egypcio
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CA%2BKr6DNdb-kMV10zgb61AZqoG=AOWMKnp1=bH9yhbtTHpUjnPw>