From owner-freebsd-questions@FreeBSD.ORG  Thu Jun 12 11:40:08 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 08CFB37B401
	for <freebsd-questions@FreeBSD.ORG>;
	Thu, 12 Jun 2003 11:40:08 -0700 (PDT)
Received: from pa-plum1b-166.pit.adelphia.net (pa-plum1b-217.pit.adelphia.net
	[24.53.161.217])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 30DA143F3F
	for <freebsd-questions@FreeBSD.ORG>;
	Thu, 12 Jun 2003 11:40:05 -0700 (PDT)
	(envelope-from wmoran@potentialtech.com)
Received: from potentialtech.com (working [172.16.0.95])
	h5CIe4Og002287;	Thu, 12 Jun 2003 14:40:04 -0400 (EDT)
	(envelope-from wmoran@potentialtech.com)
Message-ID: <3EE8C904.9000504@potentialtech.com>
Date: Thu, 12 Jun 2003 14:40:04 -0400
From: Bill Moran <wmoran@potentialtech.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.3) Gecko/20030429
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Kliment Andreev <klimenta@futurebit.com>
References: <000501c33111$4a89dd60$ca0110ac@vinyl.tkvbp.com>
In-Reply-To: <000501c33111$4a89dd60$ca0110ac@vinyl.tkvbp.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: freebsd-questions@FreeBSD.ORG
Subject: Re: ipfw + squid
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 12 Jun 2003 18:40:08 -0000

Kliment Andreev wrote:
> I have ipfw + squid (ext NIC: fxp0, int NIC: dc0). Squid is listening on
> port 3128.
> 
> Using ipfilter I will do
> 
> rdr dc0 0/0 port 80 -> 127.0.0.1 port 3128 tcp
> 
> How can I do this in ipfw
> 
> 00050 36764 12234591 divert 8668 ip from any to any via fxp0
> ---->>>>>>   00060     0        0 divert 80 tcp from any to any 3128
> 00100  4732 13839892 allow ip from any to any via lo0
> 00200     0        0 deny ip from any to 127.0.0.0/8
> 00300     0        0 deny ip from 127.0.0.0/8 to any
> 65000 53018 18345167 allow ip from any to any
> 65535     1      328 allow ip from any to any
> 
> 
> Line 60 doesn't seem to work for me.

Nope.

You don't do it with an IPFW rule, you need to pass instructions to
natd.

The canonical way to do this is in /etc/rc.conf.  Add a line like:
natd_flags="-redirect_port tcp 127.0.0.1:80 3128"

If you already have a natd_flags= line in rc.conf, just add that
to it.  Also read the man page on natd for more details.

-- 
Bill Moran
Potential Technologies
http://www.potentialtech.com