Date: Mon, 19 Nov 2012 17:56:01 -0600 From: "David DeSimone" <fox@verio.net> To: "Kevin Wilcox" <kevin.wilcox@gmail.com> Cc: freebsd-pf@freebsd.org Subject: Re: Routing return NAT traffic based on interface Message-ID: <20121119235601.GK2692@verio.net> In-Reply-To: <CAFpgnrN4UWHrkS1sGAqy6jf4vL%2BXi9b%2BoCfbZEF_T=xWt-D6tQ@mail.gmail.com> References: <CAEDV4ypAo21-4KYws0LTxC%2BXSNNtSmWvMpvFGro6BqNH2z==Wg@mail.gmail.com> <CAFpgnrO3o1==XtxDK__KmEhX1C947DHhj5N_NptKomFBba3fzQ@mail.gmail.com> <CAEDV4ypG9vA4iDVkHD2gSJ3J81DNSMjjoU2_98Jd-2V=nXHz7g@mail.gmail.com> <CAFpgnrO9r_L1syR4STqvNJHTQ2cCFo6U711JNc_Uu-_eEkTQfg@mail.gmail.com> <CAFpgnrN4UWHrkS1sGAqy6jf4vL%2BXi9b%2BoCfbZEF_T=xWt-D6tQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Kevin Wilcox <kevin.wilcox@gmail.com> wrote:
>
> On Nov 19, 2012 5:54 PM, "Kevin Wilcox" <kevin.wilcox@gmail.com> wrote:
>
> > It is. The "pass in" rule I used in my example assumes the inside
> > interface and the other devices it talks to are in the same network.
>
> Correction, the "pass in" and "nat" rules, not just the pass. They
> both have to be modified.
If I understand what you're proposing, it would be:
nat on $ext_if from $int_if:network to any -> $ext_if
pass in on $int_if from $int_if:network to any keep state
pass out on $ext_if from any to any keep state
changed to this:
nat on $ext_if from any to any -> $ext_if
pass in on $int_if from any to any keep state
pass out on $ext_if from any to any keep state
This doesn't seem right, because even traffic coming in via the external
interface will have its target IP changed to be the router, even if
it is destined for some other place. Previously you were using "from
$int_if:network" to prevent this from happening to other traffic, but
without that restriction, every packet would be subject to NAT.
If I understand the poster's problem, it is that there could be whole
worlds of other networks behind $int_if, and he is not able to predict
what IP addresses should be used to match that traffic; in fact, it is
merely the fact that the traffic is arriving on $int_if that indicates
it shoudl be NAT'd.
What I'd suggest is that packet marking be used to mark packets arriving
via $int_if, and then apply NAT to the packets that flow to $ext_if:
nat on $ext_if tagged NAT -> $ext_if
pass in on $int_if tag NAT
pass out on $ext_if
Untested configuration idea, of course. :)
--
David DeSimone == Network Admin == fox@verio.net
"I don't like spinach, and I'm glad I don't, because if I
liked it I'd eat it, and I just hate it." -- Clarence Darrow
This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20121119235601.GK2692>