Date: Wed, 04 Apr 2001 14:39:09 -0700 From: Crist Clark <crist.clark@globalstar.com> To: Nick Rogness <nick@rogness.net> Cc: "Crist J. Clark" <cjclark@alum.mit.edu>, Matthew Reimer <mreimer@vpop.net>, owensmk@earthlink.net, security@FreeBSD.ORG Subject: Re: Multiple Default Gateways using DIVERT Message-ID: <3ACB947D.16A66B4C@alum.mit.edu> References: <Pine.BSF.4.21.0104041705280.7282-100000@cody.jharris.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Nick Rogness wrote:
>
> On Wed, 4 Apr 2001, Crist J. Clark wrote:
>
> > Matthew Reimer wrote:
> > >
> > > This might be a start, though I'm not sure how NAT should fit in. You'll
> > > need the IPFIREWALL and IPFIREWALL_FORWARD kernel options.
> > >
> > > ipfw add 1000 fwd 2.2.2.1 ip from 10.10.10.0/25 to any
> > > ipfw add 2000 fwd 2.2.2.2 ip from 10.10.10.128/25 to any
> >
> > Neither of the two responses I saw looked like they would do what the
> > original
> > poster wanted. It is a start, but this one will not work as shown with
> > natd. The search will terminate with the above rules, before being
> > divert(4)ed.
>
> add 200 fwd 2.2.2.2 ip from 10.10.10.128/25 to any out recv ed0 xmit de0
> add 300 divert natd ip from any to any de0
>
> IIRC, the above rule 200 will match the inbound packet from ed0,
> change the next hop address, then be re-run through the firewall
> on the way out the interface de0 (rule 300 above) to the
> destination.
>
> I've tested this with a log rule at 250 and it seems to match the
> outbound packet, so I'm assuming this will work.
I don't think it will. That rule 200 should not work as you say. From
ipfw(8),
fwd ipaddr[,port]
... If the IP is not a local ad-
dress then the port number (if specified) is ignored and
the rule only applies to packets leaving the system.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
I am unsure how it would break tho'. That is, whether the packets fall
in the bitbucket when processed on ed0 or if they get shortcircuited to
the wire before getting to 300 when the packet crosses de0.
--
Crist J. Clark cjclark@alum.mit.edu
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3ACB947D.16A66B4C>