From owner-freebsd-net@freebsd.org Sun Feb 21 03:49:10 2016 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9DE84AAFAFE for ; Sun, 21 Feb 2016 03:49:10 +0000 (UTC) (envelope-from wblock@wonkity.com) Received: from wonkity.com (wonkity.com [67.158.26.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "wonkity.com", Issuer "wonkity.com" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 70CB18BE for ; Sun, 21 Feb 2016 03:49:10 +0000 (UTC) (envelope-from wblock@wonkity.com) Received: from wonkity.com (localhost [127.0.0.1]) by wonkity.com (8.15.2/8.15.2) with ESMTPS id u1L3n8VU082157 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 20 Feb 2016 20:49:08 -0700 (MST) (envelope-from wblock@wonkity.com) Received: from localhost (wblock@localhost) by wonkity.com (8.15.2/8.15.2/Submit) with ESMTP id u1L3n8dx082154; Sat, 20 Feb 2016 20:49:08 -0700 (MST) (envelope-from wblock@wonkity.com) Date: Sat, 20 Feb 2016 20:49:08 -0700 (MST) From: Warren Block To: Valeri Galtsev cc: freebsd-net@freebsd.org Subject: Re: gateway machine port redirect question In-Reply-To: <43887.128.135.52.6.1456021321.squirrel@cosmo.uchicago.edu> Message-ID: References: <43887.128.135.52.6.1456021321.squirrel@cosmo.uchicago.edu> User-Agent: Alpine 2.20 (BSF 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.4.3 (wonkity.com [127.0.0.1]); Sat, 20 Feb 2016 20:49:08 -0700 (MST) X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Feb 2016 03:49:10 -0000 On Sat, 20 Feb 2016, Valeri Galtsev wrote: > Dear Experts, > > I'm one of Linux refugees who several years ago migrated majority of > servers from Linux to FreeBSD and is happy since. When recently I needed > to set up gateway (Firewall + NAT) machine, I set up FreeBSD 10.2 on it, > used ipwf and natd, and all works well, machines behind gateway on LAN can > happily reach real network. I hit one snag later though: When I tried to > redirect TCP traffic on some port to machine on internal private network > behind gateway, whatever I do doesn't work. > > Could somebody point to simple example (it doesn't matter which components > are involved, I don't feel married to ipfw and natd) for FreeBSD 10.2 that > makes the machine gateway, and one of the ports of traffic coming from > public network is redirected to machine on private network behind gateway. > Something I can reproduce that works, which I then will gradually convert > into what I need. Other way around: adding redirection to already working > (and a bit sophisticated) gateway I set up appears to be beyond my mental > abilities: a couple of weeks of frustration confirm it to me. I haven't used IPFW in many years, but it can do it. For pf, this works: ext_if="em0" internal_net="192.168.1.0/24" external_addr="a.b.c.d" webserver="192.168.1.240" ... nat on $ext_if from $internal_net to any -> ($ext_if) rdr on $ext_if proto tcp from any to $external_addr port 80 -> $webserver