From owner-freebsd-pf@FreeBSD.ORG Thu Jan 10 00:11:54 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0771816A420 for ; Thu, 10 Jan 2008 00:11:54 +0000 (UTC) (envelope-from fox@verio.net) Received: from dfw-smtpout1.email.verio.net (dfw-smtpout1.email.verio.net [129.250.36.41]) by mx1.freebsd.org (Postfix) with ESMTP id DD24013C43E for ; Thu, 10 Jan 2008 00:11:53 +0000 (UTC) (envelope-from fox@verio.net) Received: from [129.250.36.63] (helo=dfw-mmp3.email.verio.net) by dfw-smtpout1.email.verio.net with esmtp id 1JCl1V-00040b-Ev for freebsd-pf@freebsd.org; Thu, 10 Jan 2008 00:11:53 +0000 Received: from [129.250.40.241] (helo=limbo.int.dllstx01.us.it.verio.net) by dfw-mmp3.email.verio.net with esmtp id 1JCl1V-0007F3-A6 for freebsd-pf@freebsd.org; Thu, 10 Jan 2008 00:11:53 +0000 Received: by limbo.int.dllstx01.us.it.verio.net (Postfix, from userid 1000) id ACE368E296; Wed, 9 Jan 2008 18:11:52 -0600 (CST) Date: Wed, 9 Jan 2008 18:11:52 -0600 From: David DeSimone To: freebsd-pf@freebsd.org Message-ID: <20080110001152.GI17784@verio.net> Mail-Followup-To: freebsd-pf@freebsd.org References: <4784F7E3.3060508@rodhouse.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; x-action=pgp-signed Content-Disposition: inline In-Reply-To: <4784F7E3.3060508@rodhouse.org> User-Agent: Mutt/1.5.9i Subject: Re: Forwarding another host X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Jan 2008 00:11:54 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Rodrique Heron wrote: > > I'm running FreeBSD 6.2 and I want to know if forwarding to a external > host is supported by PF. I want to forward all incoming traffic to > port 22 to another host, but it does not work, forwarding to a Jail > works though. Here are my configs: This is a classic NAT problem. Picture what happens each step of the way: Your firewall = A.B.C.D External Host = E.F.G.H External Client = W.X.Y.Z Packet (src = W.X.Y.Z dst = A.B.C.D) goes to the firewall. Firewall applies NAT, so packet is now (src = W.X.Y.Z, dst = E.F.G.H). Firewall routes the packet back out to the external network that it came from. External host receives packet (src = W.X.Y.Z, dst = E.F.G.H). External host sends back a reply packet (src = E.F.G.H, dst = W.X.Y.Z). This reply goes straight back over the internet; it does not ever come back to your firewall, but goes directly back to the client. Firewall does not see reply, so there is no chance to apply reverse NAT. Client receives packet (src = E.F.G.H, dst = W.X.Y.Z). The packet is unrecognized, however, because the packet that the client originally sent was for (src = W.X.Y.Z dst = A.B.C.D). Client sends a RST. Connection fails. The way I have solved this problem in other environments is with "double NAT" where the firewall translates both the Source and Destination IP for internally-receive traffic. The firewall applies the correct destination NAT, but also applies NAT to the source IP, giving its own IP. This causes the external server to reply back to the firewall so that the traffic can be de-NAT'd correctly. However, I am unaware of the ability to perform Double NAT using FreeBSD tools. There is no reason the kernel could not do it; it is just a missing feature in the toolset. Offhand I am not sure why you would want to forward traffic from your host over to some external host. If you really must do this, the only way that comes to mind would be using a proxy of some sort, opening a secondary connection to the external host on behalf of the client. - -- David DeSimone == Network Admin == fox@verio.net "This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, dis- tribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you." --Lawyer Bot 6000 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFHhWLIFSrKRjX5eCoRAu2dAJ48q+buSKrw7W3tlS1OMrgbHa/rlQCfaRtt 9FQyd2Mn9fwdQMD3f7LfRI8= =oxGv -----END PGP SIGNATURE-----