From owner-freebsd-pf@FreeBSD.ORG Sun Aug 21 09:31:28 2011 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 44D1C106564A for ; Sun, 21 Aug 2011 09:31:28 +0000 (UTC) (envelope-from mistrzipan@gmail.com) Received: from mail-fx0-f54.google.com (mail-fx0-f54.google.com [209.85.161.54]) by mx1.freebsd.org (Postfix) with ESMTP id C80088FC08 for ; Sun, 21 Aug 2011 09:31:27 +0000 (UTC) Received: by fxe4 with SMTP id 4so3665677fxe.13 for ; Sun, 21 Aug 2011 02:31:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=K1n/slZQCLMJv0hGC52W7rpKXlbqeS3BWqpkW42IFeI=; b=IUvsH0MnUDAMbBmolKHcrT8Q+kMx65UCEy6p7DDSj0pWYsPo7KbWoYPKmorPn2iAuf 6/CorJ2UwUdAU/A6f9JaXNh6sSJqN2pngzxoFXodTz4xQADmm5+ylst/SIRd2FlddqE0 r6ab8w7EaZQlOQVfZarYs66lHFrmk7r6Gt0xY= Received: by 10.223.23.6 with SMTP id p6mr1838097fab.112.1313917756110; Sun, 21 Aug 2011 02:09:16 -0700 (PDT) Received: from [192.168.32.109] (dynamic-78-8-236-218.ssp.dialog.net.pl [78.8.236.218]) by mx.google.com with ESMTPS id r11sm3362710faa.24.2011.08.21.02.09.14 (version=TLSv1/SSLv3 cipher=OTHER); Sun, 21 Aug 2011 02:09:15 -0700 (PDT) Message-ID: <4E50CB38.1050204@gmail.com> Date: Sun, 21 Aug 2011 11:09:12 +0200 From: "Bartek W. aka Mastier" User-Agent: Mozilla/5.0 (X11; Linux i686; rv:6.0) Gecko/20110812 Thunderbird/6.0 MIME-Version: 1.0 To: freebsd-pf@freebsd.org References: In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: problem with setting nat X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Aug 2011 09:31:28 -0000 W dniu 21.08.2011 09:48, h bagade pisze: > Hi all, > > I am trying to use pf nat rules with pool support on FreeBsd 8.0, working > together with ipfw as the main firewall. According to the natting concepts i > faced in manuals and docs, nat concept is to map the source address to the > natted address when sending the packets from that source and then map the > destination address of the related reply packets. > > but when I define pf nat rules with a pool of IP addresses not available on > the outside interface ip addresses, the outgoing traffic is natted to one of > the pool addresses but the response is not received via that interface so > the pf can map the destination address to the real one. here is one of my > configs i used during my tests: > > *configurations:* > *pf.conf:* > nat on eth1 from { 11.11.11.0/24} to any -> > {172.16.10.1,172.16.10.2,172. > 16.10.3,172.16.10.4,172.16.10.5,172.16.10.6,172.16.10.7,172.16.10.8,172.16.10.9,172.16.10.10} > > main system configurations: > eth0: 11.11.11.1 > eth1: 172.16.10.64 > > system A: directly connected to eth0- 11.11.11.11 > system B: directly connected to eth1- 172.16.10.65 > > in this configs the dafult route of system A and system B are the middle > systems connected ip address. > > as mentioned, when systemA pings systemB, the ping requests are natted to > 172.16.10.1 and received at systemB but systemB doesn't send icmp replies > because it doesn't know to whom it should send the replies (no answer to > system B 's ARP requests about who has the natted IP). Man, ok, let's start from the beginning: these are your nat adresses {172.16.10.1,172.16.10.2,172. 16.10.3,172.16.10.4,172.16.10.5,172.16.10.6,172.16.10.7,172.16.10.8,172.16.10.9,172.16.10.10} But none of them is set on your routing/natting system interface, come on :-D How can it receive response over link layer (L2) if doesn't have IP which is substited to make packets get back to. If you are doing nat to 172.16.10.1, you should have 172.16.10.1 on your auxiliary interface , not 172.16.10.64. Or propably you could make nat like i.e. .... -> {172.16.10.0/24, ... } , but I have never tried it like that. > > now my question is, isn't it the pf nat responsibilty to manage this > condition and send the ARP replies to SystemB? Hell no, ARP replies ? man this is link layer, ARP is from link layer. To have ARP response (NOT PING, ping is layer 3, IP layer) both side must share the same network, natting can see the ARP from both sides , but systemA and SystemB between each other can't. > or, are my configs wrong? > or i misunderstood the nat concepts? You should have some reading, there are more than one, so called NAT techniques. In PF , in your situation, when packet is going out from systemA to systemB, the source address in switched to NAT machine's and , in case of port-enabled protocol, like TCP and UDP the random port is choosen and waiting for response on that port. When it comes from system B is rightaway redirected to systemA. I don't know how it works in ICMP (i.e. ping), it's in some way "remembered", who is waiting for response. > any ideas or helps are really appreciated as i have to set this nat on my > main system, asap. > Thanks in advance. > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"