From owner-freebsd-ipfw@freebsd.org  Fri Jan 17 15:53:40 2020
Return-Path: <owner-freebsd-ipfw@freebsd.org>
Delivered-To: freebsd-ipfw@mailman.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.nyi.freebsd.org (Postfix) with ESMTP id C66CB1F2664
 for <freebsd-ipfw@mailman.nyi.freebsd.org>;
 Fri, 17 Jan 2020 15:53:40 +0000 (UTC)
 (envelope-from lutz@donnerhacke.de)
Received: from annwfn.iks-jena.de (annwfn.iks-jena.de [IPv6:2001:4bd8::19])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 47zlwM3K4Wz4fBc
 for <freebsd-ipfw@freebsd.org>; Fri, 17 Jan 2020 15:53:38 +0000 (UTC)
 (envelope-from lutz@donnerhacke.de)
X-SMTP-Sender: IPv6:2001:4bd8:59:1:172:27:107:102
Received: from lyoness (lyoness.intern.iks-service.de
 [IPv6:2001:4bd8:59:1:172:27:107:102])
 by annwfn.iks-jena.de (8.15.2/8.15.2) with ESMTP id 00HFrYEx014084;
 Fri, 17 Jan 2020 16:53:34 +0100
From: "Lutz Donnerhacke" <lutz@donnerhacke.de>
To: "'Paul Procacci'" <pprocacci@gmail.com>, <freebsd-ipfw@freebsd.org>
References: <CAFbbPuhGBEMCyexxQiareD6txd4Ehoq2WQWxw+O5hio_Out92g@mail.gmail.com>
 <CAFbbPug7s8+hS2UfudAytpo4sirFXYGREiHKH2Qiu=qiCbsMUQ@mail.gmail.com>
In-Reply-To: <CAFbbPug7s8+hS2UfudAytpo4sirFXYGREiHKH2Qiu=qiCbsMUQ@mail.gmail.com>
Subject: AW: Stateful NAT w/ record-state
Date: Fri, 17 Jan 2020 16:53:33 +0100
Message-ID: <008201d5cd4e$45e49890$d1adc9b0$@donnerhacke.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
Content-Language: de
Thread-Index: AQFzT04RaTDHPcBSNc0s7ntmVtjUbQMDtdzDqJvgHJA=
X-Rspamd-Queue-Id: 47zlwM3K4Wz4fBc
X-Spamd-Bar: /
Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none;
 spf=none (mx1.freebsd.org: domain of lutz@donnerhacke.de has no SPF policy
 when checking 2001:4bd8::19) smtp.mailfrom=lutz@donnerhacke.de
X-Spamd-Result: default: False [1.00 / 15.00]; ARC_NA(0.00)[];
 NEURAL_HAM_MEDIUM(-0.15)[-0.148,0]; FROM_HAS_DN(0.00)[];
 TO_DN_SOME(0.00)[]; MIME_GOOD(-0.10)[text/plain];
 RCVD_TLS_LAST(0.00)[]; DMARC_NA(0.00)[donnerhacke.de];
 AUTH_NA(1.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[];
 RCPT_COUNT_TWO(0.00)[2];
 RCVD_IN_DNSWL_NONE(0.00)[9.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.d.b.4.1.0.0.2.list.dnswl.org
 : 127.0.5.0]; NEURAL_SPAM_LONG(0.25)[0.251,0];
 R_SPF_NA(0.00)[]; FREEMAIL_TO(0.00)[gmail.com];
 FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[];
 MIME_TRACE(0.00)[0:+];
 ASN(0.00)[asn:15725, ipnet:2001:4bd8::/29, country:DE];
 MID_RHS_MATCH_FROM(0.00)[];
 IP_SCORE(-0.00)[country: DE(-0.02)]; RCVD_COUNT_TWO(0.00)[2]
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw/>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 17 Jan 2020 15:53:40 -0000

> >                       In Kernel Nat/Firewall
> >                         /---------------------\
> > +--------+     +-------+    +-----+    +-------+    +-------+
> > | Client | --- |  igb0 | --- | Nat | --- | igb1 | --- | Host |
> > +--------+     +-------+    +-----+    +-------+    +-------+
> >
> > Requests originate from "client", come in via "igb0", get passed to
"nat",
> > leave "igb1" reaching host .... no problem.
> >
> > 03000 nat 1 ip from any to any out via igb0

Jup.

> > The response leaving "host", come in via "igb1", get passed to "nat",
and
> > get clobbered by ipfw's deny rule (see below).
> >
> > 50100 nat 1 ip from any to me in via igb0

igb1 != igb0

I'd suggest to apply nat any traffic on igb1 in both direction.
So routing is much easier (you never see the public NAT IP).