From owner-freebsd-security@FreeBSD.ORG  Mon Jun  2 08:21:08 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8F97D37B401
	for <freebsd-security@freebsd.org>;
	Mon,  2 Jun 2003 08:21:08 -0700 (PDT)
Received: from mx.vipnet.ro (cosmic.vipnet.ro [193.230.219.1])
	by mx1.FreeBSD.org (Postfix) with SMTP id DE69943F85
	for <freebsd-security@freebsd.org>;
	Mon,  2 Jun 2003 08:21:06 -0700 (PDT)	(envelope-from vladg@vipnet.ro)
Received: (qmail 39130 invoked from network); 2 Jun 2003 15:22:02 -0000
Received: from unknown (HELO snakepit.halted.net) (141.85.1.89)
  by cosmic.vipnet.ro with SMTP; 2 Jun 2003 15:22:02 -0000
Date: Mon, 2 Jun 2003 18:22:31 +0300
From: Vlad Galu <vladg@vipnet.ro>
To: freebsd-security@freebsd.org
Message-Id: <20030602182231.47fec3ea.vladg@vipnet.ro>
In-Reply-To: <20030602181753.A27202@irpen.kiev.ua>
References: <20030531122028.A16361@irpen.kiev.ua>
	<20030602104108.Q40213@localhost>
	<20030602181753.A27202@irpen.kiev.ua>
Organization: VipNET Bucharest
X-Mailer: Sylpheed version 0.9.0 (GTK+ 1.2.10; i386-portbld-freebsd4.8)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: Re: Packet flow through IPFW+IPF+IPNAT ?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Jun 2003 15:21:08 -0000

On Mon, 2 Jun 2003 18:17:53 +0300
Vandyuk Eugene <duke@irpen.kiev.ua> wrote:

> On Mon, Jun 02, 2003 at 10:43:07AM -0400, Matthew George wrote:
> > On Sat, 31 May 2003, Vandyuk Eugene wrote:
> >
> > > What's the path?
> > >    incoming: IPFW Layer2 -> IPFW&Dummynet -> IPNAT -> IPFilter ?
> > >    outgoing: IPFW Layer2 -> IPFW&Dummynet -> IPFilter -> IPNAT ?
> > > Is this correct? Or IPNAT on the incoming packets run before IPFW L3:
> > >    incoming: IPFW Layer2 -> IPNAT -> IPFW&Dummynet -> IPFilter ?
> > > I think this path is more preferable, because IPFW always use not
> > > masqueraded IP-headers.
> > >
> >
> > I have ipfw compiled in and run ipfilter as a kld
> >
> > the way it works is ipfw -> ipnat -> ipfilter
> >
> > ipnat and all state matching for ipfilter is performed prior to ruleset
> > processing
> >
> 
> But this way only for incoming packets. And wat's the way for outgoing?
>   IPFW -> IPFilter -> IPNAT   OR   IPFilter -> IPNAT -> IPFW  ???
> 
	It's the same way as for input, only in reverse order.

> _______________________________________________
> freebsd-security@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
> 


--