From owner-freebsd-questions Sun Feb 17 22:41:57 2002 Delivered-To: freebsd-questions@freebsd.org Received: from rwcrmhc52.attbi.com (rwcrmhc52.attbi.com [216.148.227.88]) by hub.freebsd.org (Postfix) with ESMTP id 68AF537B404 for ; Sun, 17 Feb 2002 22:41:51 -0800 (PST) Received: from blossom.cjclark.org ([12.234.91.48]) by rwcrmhc52.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020218064151.RZAP1147.rwcrmhc52.attbi.com@blossom.cjclark.org>; Mon, 18 Feb 2002 06:41:51 +0000 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.6) id g1I6fo133751; Sun, 17 Feb 2002 22:41:50 -0800 (PST) (envelope-from cjc) Date: Sun, 17 Feb 2002 22:41:50 -0800 From: "Crist J. Clark" To: Will Froning Cc: questions@FreeBSD.ORG Subject: Re: natd and dynamic rules Message-ID: <20020217224150.U48401@blossom.cjclark.org> References: <20020217201322.E46783-100000@angui.sh> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20020217201322.E46783-100000@angui.sh>; from wfroning@angui.sh on Sun, Feb 17, 2002 at 08:13:51PM -0800 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sun, Feb 17, 2002 at 08:13:51PM -0800, Will Froning wrote: > [please CC me on replies, thanks] > > I have an issue with natd and my dynamic ipfw rules. Here goes. > > I recently implemented natd on my FBSD4.5 firewall. Here are the > relevant ipfw rules (internal ip=192.168.100.1): > > 01400 divert 8668 ip from any to any via dc0 > 01500 check-state > 01600 deny log tcp from any to any established > 01700 allow tcp from ${oip} to any keep-state out setup > 02800 allow ip from 192.168.100.0/24 to any keep-state via dc1 > > When I start a ssh session from my firewall to my mail server the > dynamic rule gets the correct lifetime value from > net.inet.ip.fw.dyn_ack_lifetime. > > When I start a ssh session from 192.168.100.2 to my firewall's > internal interface, I again get the correct lifetime value from > net.inet.ip.fw.dyn_ack_lifetime. > > When I start a ssh session from 192.168.100.2 to a remote machine, the > packet gets through just fine. But when the dynamic rules come up I > was suspecting both 2800 and 1700 to have the same lifetime value. > That's not the case. It seems when natd sends the packet out, the > outgoing packet gets it's lifetime value from > net.inet.ip.fw.dyn_syn_lifetime NOT net.inet.ip.fw.dyn_ack_lifetime! > > So my questions are these: > > 1) Is this purposely done by implementation or is this a bug in either > ipfw or natd? > > 2) If this is a "feature", is there any way to change this to have > both rules look at the same lifetime value? It always seems like questions come in groups. http://docs.freebsd.org/cgi/getmsg.cgi?fetch=13412+0+archive/2002/freebsd-net/20020217.freebsd-net http://docs.freebsd.org/cgi/getmsg.cgi?fetch=2858187+0+archive/2002/freebsd-questions/20020217.freebsd-questions -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message