From owner-freebsd-questions Thu Oct 10 13:39:54 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5AC4237B401 for ; Thu, 10 Oct 2002 13:39:52 -0700 (PDT) Received: from dsl-64-128-185-9.telocity.com (dsl-64-128-185-9.telocity.com [64.128.185.9]) by mx1.FreeBSD.org (Postfix) with ESMTP id DFAE643ED8 for ; Thu, 10 Oct 2002 13:39:50 -0700 (PDT) (envelope-from mjoyner2@hq.dyns.cx) Received: (from root@localhost) by dsl-64-128-185-9.telocity.com (8.11.5/8.11.5) id g9AKcOg31776; Thu, 10 Oct 2002 16:38:24 -0400 (EDT) (envelope-from mjoyner2@hq.dyns.cx) Received: from ip-24.internal (ip-34.internal [192.168.2.34]) by hq.dyns.cx (8.11.5/8.11.5av) with ESMTP id g9AKcKl31762; Thu, 10 Oct 2002 16:38:21 -0400 (EDT) (envelope-from mjoyner2@hq.dyns.cx) Received: from hq.dyns.cx (localhost [127.0.0.1]) by ip-24.internal (8.12.6/8.12.6) with ESMTP id g9AKdYx2030197; Thu, 10 Oct 2002 16:39:34 -0400 (EDT) (envelope-from mjoyner2@hq.dyns.cx) Message-ID: <3DA5E586.5000400@hq.dyns.cx> Date: Thu, 10 Oct 2002 16:39:34 -0400 From: wolf User-Agent: Mozilla/5.0 (X11; U; Linux i386; en-US; rv:0.9.4.1) Gecko/20020508 Netscape6/6.2.3 X-Accept-Language: en-us MIME-Version: 1.0 To: Marc Hunter , questions Subject: Re: ipfw and natd during internal to internal access ... References: <4.2.0.58.20021010130144.00bc7a10@192.168.0.64> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by AMaViS perl-11 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG The request never hits the firewall rule for it to get diverted into nat. (via INTERFACE, it never goes into that interface). While I know the cause, I am not sure as to the fix. Though I am sure an additional firewall rule would probably work to fix it. Maybe something like divert 8668 ip from 192.168/16 to 24.70.100.100 divert 8668 ip from 24.70.100.100 to 192.168/16 Eat this with lots of salt and make sure your at the console. Marc Hunter wrote: > Hi, > > We have just implemented an ipfw and natd firewall and generally it > works great. We are using natd for traffic going out and to redirect > outside traffic on port 80 to a particular webserver. However, when a > machine within the network attempts to access the web server through its > external address (using the domain name for instance) it doesn't work. > > Is there some special trick to deal with this? > > An example to summarize: > > Firewall > - External IP: 24.70.100.100 > - Internal IP: 192.168.0.64 > > Webserver > - IP: 192.168.0.128 > > User machine > - IP: 192.168.0.200 > > We have a domain mapped to 24.70.100.100, and when the web request is > initiated from outside the network, it all works fine, from inside, it > fails. Inside access to the rest of the web works fine (so natd is > working going out and the redirect_port is working for those coming in). > > Any tips? > > Thanks! > > Marc > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message