Date: Sun, 21 Aug 2011 09:24:27 -1000 From: David Cornejo <dave@dogwood.com> To: h bagade <bagadeh@gmail.com> Cc: freebsd-net@freebsd.org Subject: Re: problem with setting nat using pf Message-ID: <CAFnjQbsVHwd%2B514ATB%2Bhg72S9QWcpE5s%2B9zax6UP79T5nzMuNA@mail.gmail.com> In-Reply-To: <CAARSjE0-6zedkOtC2%2B1TRk3qN7Tf3O7vTgy6bsODm4T8KwaSeg@mail.gmail.com> References: <CAARSjE0-6zedkOtC2%2B1TRk3qN7Tf3O7vTgy6bsODm4T8KwaSeg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Aug 20, 2011 at 9:47 PM, h bagade <bagadeh@gmail.com> wrote:
> Hi all,
>
> I am trying to use pf nat rules with pool support on FreeBsd 8.0, working
> together with ipfw as the main firewall. According to the natting concepts
> i
> faced in manuals and docs, nat concept is to map the source address to the
> natted address when sending the packets from that source and then map the
> destination address of the related reply packets.
>
> but when I define pf nat rules with a pool of IP addresses not available on
> the outside interface ip addresses, the outgoing traffic is natted to one
> of
> the pool addresses but the response is not received via that interface so
> the pf can map the destination address to the real one. here is one of my
> configs i used during my tests:
>
> *configurations:*
> *pf.conf:*
> nat on eth1 from { 11.11.11.0/24} to any ->
> {172.16.10.1,172.16.10.2,172.
>
> 16.10.3,172.16.10.4,172.16.10.5,172.16.10.6,172.16.10.7,172.16.10.8,172.16.10.9,172.16.10.10}
>
> main system configurations:
> eth0: 11.11.11.1
> eth1: 172.16.10.64
>
> system A: directly connected to eth0- 11.11.11.11
> system B: directly connected to eth1- 172.16.10.65
>
> in this configs the dafult route of system A and system B are the middle
> systems connected ip address.
>
> as mentioned, when systemA pings systemB, the ping requests are natted to
> 172.16.10.1 and received at systemB but systemB doesn't send icmp replies
> because it doesn't know to whom it should send the replies (no answer to
> system B 's ARP requests about who has the natted IP).
>
> now my question is, isn't it the pf nat responsibilty to manage this
> condition and send the ARP replies to SystemB?
> or, are my configs wrong?
> or i misunderstood the nat concepts?
>
> any ideas or helps are really appreciated as i have to set this nat on my
> main system, asap.
> Thanks in advance.
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
>
ARP is not handled by pf. You need to get the interface to respond to that
IP address by creating an alias for the address using ifconfig - if you need
more help please post your rc.conf
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAFnjQbsVHwd%2B514ATB%2Bhg72S9QWcpE5s%2B9zax6UP79T5nzMuNA>