From owner-freebsd-pf@FreeBSD.ORG Wed Dec 25 18:10:56 2013 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id EF6A0D30 for ; Wed, 25 Dec 2013 18:10:56 +0000 (UTC) Received: from relay.ibs.dn.ua (relay.ibs.dn.ua [91.216.196.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 710AD17F0 for ; Wed, 25 Dec 2013 18:10:55 +0000 (UTC) Received: from ibs.dn.ua (relay.ibs.dn.ua [91.216.196.25]) by relay.ibs.dn.ua with ESMTP id rBPI9ohx021788 for ; Wed, 25 Dec 2013 20:09:51 +0200 (EET) Message-ID: <20131225200950.21787@relay.ibs.dn.ua> Date: Wed, 25 Dec 2013 20:09:50 +0200 From: "Zeus Panchenko" To: cc: Subject: nat before ipsec ... Organization: I.B.S. LLC X-Mailer: MH-E 8.3.1; GNU Mailutils 2.99.98; GNU Emacs 24.0.93 X-Face: &sReWXo3Iwtqql1[My(t1Gkx; y?KF@KF`4X+'9Cs@PtK^y%}^.>Mtbpyz6U=,Op:KPOT.uG )Nvx`=er!l?WASh7KeaGhga"1[&yz$_7ir'cVp7o%CGbJ/V)j/=]vzvvcqcZkf; JDurQG6wTg+?/xA go`}1.Ze//K; Fk&/&OoHd'[b7iGt2UO>o(YskCT[_D)kh4!yY'<&:yt+zM=A`@`~9U+P[qS:f; #9z~ Or/Bo#N-'S'!'[3Wog'ADkyMqmGDvga?WW)qd=?)`Y&k=o}>!ST\ MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Zeus Panchenko List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Dec 2013 18:10:57 -0000 =2D----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, please, may somebody help with the subj? is it possible at all on FreeBSD with pf? I need to binat some of my LAN (network A) ip addresses to some of secure communication addresses (network B) for, behind IPSec network C, access target <-> world <--> em0 - freebsd - vlanA <--> LAN ^ ^ net A | | +- netC -.-.-.-.- IPSec -.-.-.-.- net B -+ when I land some B network address on freebsd box, than everything from that address works but, when I try to bi/nat some network A address to some network B address, it is not in pf.conf I try this: binat on vlanA from A1 to C3 -> B2 where: A1 is some address from net A B2 is some address from net B C3 is some address from net C I can see incoming packets from A1 to C3 on interface vlanA, but after that, packets "disappears", I can not find them any other interface and no return packets as far as I know I need "nat before vpn" ... but I was not able to find how to do that ... can I do that with pf on freebsd? I run FreeBSD 9.2-PRERELEASE #6 r255856: amd64 with system pf please, help me understand what am I missing ... =2D --=20 Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) =2D----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlK7H24ACgkQr3jpPg/3oypenQCeI6R+2lILmP0UxDT273T1S8nU 078AoJ3n1NRfU4L0pSrOKSDYovMpbIRF =3D2FPq =2D----END PGP SIGNATURE-----