From owner-freebsd-pf@FreeBSD.ORG Tue Nov 20 00:14:27 2012 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id E9AA6BF9 for ; Tue, 20 Nov 2012 00:14:26 +0000 (UTC) (envelope-from ddesimone@verio.net) Received: from relay1-bcrtfl2.verio.net (relay1-bcrtfl2.verio.net [131.103.218.142]) by mx1.freebsd.org (Postfix) with ESMTP id 94CD98FC17 for ; Tue, 20 Nov 2012 00:14:26 +0000 (UTC) Received: from iad-wprd-xchw01.corp.verio.net (iad-wprd-xchw01.corp.verio.net [198.87.7.164]) by relay1-bcrtfl2.verio.net (Postfix) with ESMTP id 44EDEB03813A; Mon, 19 Nov 2012 18:56:05 -0500 (EST) Thread-Index: Ac3GsW+zKhByJDK6Thyc9WY/mM8dSw== Received: from hometx-733b1p1.corp.verio.net ([10.144.2.53]) by iad-wprd-xchw01.corp.verio.net over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Mon, 19 Nov 2012 18:56:03 -0500 Received: by hometx-733b1p1.corp.verio.net (sSMTP sendmail emulation); Mon, 19 Nov 2012 17:56:01 -0600 Date: Mon, 19 Nov 2012 17:56:01 -0600 From: "David DeSimone" To: "Kevin Wilcox" Content-Transfer-Encoding: 7bit Subject: Re: Routing return NAT traffic based on interface Message-ID: <20121119235601.GK2692@verio.net> Mail-Followup-To: Kevin Wilcox , Peter McAlpine , freebsd-pf@freebsd.org References: Content-class: urn:content-classes:message X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4913 MIME-Version: 1.0 Importance: normal Priority: normal Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: Precedence: bulk User-Agent: Mutt/1.5.20 (2009-12-10) X-OriginalArrivalTime: 19 Nov 2012 23:56:03.0726 (UTC) FILETIME=[6EFDF2E0:01CDC6B1] Cc: freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.14 List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Nov 2012 00:14:27 -0000 Kevin Wilcox wrote: > > On Nov 19, 2012 5:54 PM, "Kevin Wilcox" wrote: > > > It is. The "pass in" rule I used in my example assumes the inside > > interface and the other devices it talks to are in the same network. > > Correction, the "pass in" and "nat" rules, not just the pass. They > both have to be modified. If I understand what you're proposing, it would be: nat on $ext_if from $int_if:network to any -> $ext_if pass in on $int_if from $int_if:network to any keep state pass out on $ext_if from any to any keep state changed to this: nat on $ext_if from any to any -> $ext_if pass in on $int_if from any to any keep state pass out on $ext_if from any to any keep state This doesn't seem right, because even traffic coming in via the external interface will have its target IP changed to be the router, even if it is destined for some other place. Previously you were using "from $int_if:network" to prevent this from happening to other traffic, but without that restriction, every packet would be subject to NAT. If I understand the poster's problem, it is that there could be whole worlds of other networks behind $int_if, and he is not able to predict what IP addresses should be used to match that traffic; in fact, it is merely the fact that the traffic is arriving on $int_if that indicates it shoudl be NAT'd. What I'd suggest is that packet marking be used to mark packets arriving via $int_if, and then apply NAT to the packets that flow to $ext_if: nat on $ext_if tagged NAT -> $ext_if pass in on $int_if tag NAT pass out on $ext_if Untested configuration idea, of course. :) -- David DeSimone == Network Admin == fox@verio.net "I don't like spinach, and I'm glad I don't, because if I liked it I'd eat it, and I just hate it." -- Clarence Darrow This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.