Date: Fri, 12 Apr 2002 16:09:13 -0500 (CDT) From: Nick Rogness <nick@rogness.net> To: "Artyom V. Viklenko" <artem@mipk-kspu.kharkov.ua> Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: policy-driven routing with ipfw Message-ID: <Pine.BSF.4.21.0204121401320.68483-100000@cody.jharris.com> In-Reply-To: <3CB6E3B8.F26ECFDB@mipk-kspu.kharkov.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 12 Apr 2002, Artyom V. Viklenko wrote: > Hi! Help me, please. > > I have FreeBSD 4.5-STABE box with 3 NICs (NE2000-clones). > > First - ed0 - connected to internal network with address, say, > 192.168.1.1. Second - ed1 - connected to ISP #1 with ip 10.0.1.1. > Third - ed2 - to ISP #2 with ip 10.0.2.1. OK. > > The default route is through ed1. > > Clients with ips 192.168.1.1-192.168.1.127 should get access to > outside world via ed1, and rest client - via ed2. > OK. > I have set up 'ipfw fwd' rules to point out ISPs' router addresses, > say 10.0.1.254 and 10.0.2.254 respectively: > > # ipfw add 1000 fwd 10.0.1.254 ip from 192.168.1.0/25 to not > 192.168.1.0/24 in recv ed0 > # ipfw add 2000 fwd 10.0.2.254 ip from 192.168.1.128/25 to not > 192.168.1.0/24 in recv ed0 > > All ok at this point. > > The last wish is to use NAT on both outside interfaces to hide > > And I have set up two divert rules and natd daemons: > > # natd -p 2000 -interface ed1 > # natd -p 2001 -interface ed2 > # ipfw add 3000 divert 2000 ip from any to any via ed1 > # ipfw add 4000 divert 2001 ip from any to any via ed2 > > But packets never pass to these rules. :( What version are you running? It used to be that fwd only worked on outbound connections. There was talk on the list that this behavious has changed. There are several workarounds, one of which is a firewall like so: # Catch packets leaving ed1 (default gateway), send them to # ed2 gateway 100 fwd 10.0.2.254 ip from 192.168.1.128/25 to any out via ed1 # Normal default traffic natd 200 divert natd ip from any to any via ed1 # Natd for second interface 300 divert natd ip from any to any via ed2 # Allow for now 400 allow ip from any to any > > ipfw(8) man page says that search terminates on matching fwd rule. But > as I remember, ip packet passes ipfw rules twice. First pass, IMHO, > will change next hop at entering stack via ed0. And at second pass > when packet leawing machine via ed1(2) packet should be diverted. > > Where is my mistake? What I'm doing wrong? > > Kernel variable net.inet.ip.fw.one_pass does not affect this > situation. This is only for pipes, isn't it? Yes. Nick Rogness <nick@rogness.net> - Don't mind me...I'm just sniffing your packets To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0204121401320.68483-100000>