From owner-freebsd-net@FreeBSD.ORG  Sat Sep  6 03:15:47 2014
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id F2B584D8
 for <freebsd-net@freebsd.org>; Sat,  6 Sep 2014 03:15:47 +0000 (UTC)
Received: from sdf.lonestar.org (mx.sdf.org [192.94.73.24])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "mx.sdf.org", Issuer "SDF.ORG" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id D57D71790
 for <freebsd-net@freebsd.org>; Sat,  6 Sep 2014 03:15:47 +0000 (UTC)
Received: from otaku.freeshell.org (IDENT:case@otaku.freeshell.org
 [192.94.73.9])
 by sdf.lonestar.org (8.14.8/8.14.5) with ESMTP id s863FVKw020579
 (using TLSv1/SSLv3 with cipher DHE-RSA-AES256-SHA (256 bits) verified NO)
 for <freebsd-net@freebsd.org>; Sat, 6 Sep 2014 03:15:31 GMT
Date: Sat, 6 Sep 2014 03:15:31 +0000 (UTC)
From: John Case <case@SDF.ORG>
X-X-Sender: case@faeroes.freeshell.org
To: freebsd-net@freebsd.org
Subject: When to use and not use divert/natd ...
Message-ID: <Pine.NEB.4.64.1409060308140.2500@faeroes.freeshell.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 06 Sep 2014 03:15:48 -0000


Hello,

For many years I would build FreeBSD firewalls and they would be very, 
very simple - I just set gateway_enable="yes" in rc.conf and everything 
just worked.

However, these firewalls *always* had real, routable IPs no both sides. 
Both interfaces had real, routable IPs.

Now I have a firewall that has two non-routable IPs for its interfaces, 
and is connected to a internet router with the real IP.  When I try to 
builda  very simple firewall  it does not work, and I am forced to use 
ipdivert and natd.

If I use ipdivert and natd, it works just fine.

So, am I correct that I can create a simple gateway without natd/divert as 
long as both interfaces are real IPs, but if both interfaces are 
non-routable IPs, I am forced to use divert/natd ?

Is that correct ?