From owner-freebsd-security  Mon Jun 18 11:41: 2 2001
Delivered-To: freebsd-security@freebsd.org
Received: from peitho.fxp.org (peitho.fxp.org [209.26.95.40])
	by hub.freebsd.org (Postfix) with ESMTP id 5755737B401
	for <freebsd-security@FreeBSD.ORG>; Mon, 18 Jun 2001 11:40:59 -0700 (PDT)
	(envelope-from cdf.lists@fxp.org)
Received: by peitho.fxp.org (Postfix, from userid 1501)
	id 4FD6E1360C; Mon, 18 Jun 2001 14:40:58 -0400 (EDT)
Date: Mon, 18 Jun 2001 14:40:58 -0400
From: Chris Faulhaber <jedgar@fxp.org>
To: Chris Kesler <chris@pconline.com>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: ipnat.conf oddity
Message-ID: <20010618144057.B72197@peitho.fxp.org>
Mail-Followup-To: Chris Faulhaber <jedgar@fxp.org>,
	Chris Kesler <chris@pconline.com>, freebsd-security@FreeBSD.ORG
References: <Pine.LNX.3.95.1010618132448.5151M-100000@newton.pconline.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="3lcZGd9BuhuYXNfi"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <Pine.LNX.3.95.1010618132448.5151M-100000@newton.pconline.com>; from chris@pconline.com on Mon, Jun 18, 2001 at 01:34:13PM -0500
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--3lcZGd9BuhuYXNfi
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jun 18, 2001 at 01:34:13PM -0500, Chris Kesler wrote:
> This is my current ipnat.conf file.
>=20
> map vx0 192.168.1.0/24 -> 0/32 portmap tcp/udp 1025:65000
> map vx0 192.168.1.0/24 -> 0/32
>=20
> Notice that the address to the right of the -> is 0.  I discovered by
> accident that this configuration works on my system.  I'm using ipnat and
> ipf on 4.3-RELEASE.
>=20
> I couldn't find any docs describing why this config works.  I have a cable
> modem connection, and the DHCP-assigned IP address changes once in a
> while. I wonder if this is a feature intended to allow me to continue to
> forward packets after my address changes.  Or is it a bad idea to run the
> box this way?
>=20

See http://www.obfuscation.org/ipf/ipf-howto.txt

--=20
Chris D. Faulhaber - jedgar@fxp.org - jedgar@FreeBSD.org
--------------------------------------------------------
FreeBSD: The Power To Serve   -   http://www.FreeBSD.org

--3lcZGd9BuhuYXNfi
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: FreeBSD: The Power To Serve

iEYEARECAAYFAjsuSzkACgkQObaG4P6BelCyIACbBSXo+kVAGORGF/kXB5nIf3Yf
OcUAniNwthzYsqAVsCIacHt2W+Bip3Rx
=EHKT
-----END PGP SIGNATURE-----

--3lcZGd9BuhuYXNfi--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message