From owner-freebsd-ipfw@FreeBSD.ORG  Thu Apr  8 16:35:37 2010
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: ipfw@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id DCDF61065680
	for <ipfw@freebsd.org>; Thu,  8 Apr 2010 16:35:37 +0000 (UTC)
	(envelope-from roberthuff@rcn.com)
Received: from smtp02.lnh.mail.rcn.net (smtp02.lnh.mail.rcn.net
	[207.172.157.102])
	by mx1.freebsd.org (Postfix) with ESMTP id 9F0E68FC19
	for <ipfw@freebsd.org>; Thu,  8 Apr 2010 16:35:37 +0000 (UTC)
Received: from mr02.lnh.mail.rcn.net ([207.172.157.22])
	by smtp02.lnh.mail.rcn.net with ESMTP; 08 Apr 2010 12:35:37 -0400
Received: from smtp01.lnh.mail.rcn.net (smtp01.lnh.mail.rcn.net [207.172.4.11])
	by mr02.lnh.mail.rcn.net (MOS 3.10.8-GA) with ESMTP id QPX63212;
	Thu, 8 Apr 2010 12:35:36 -0400 (EDT)
Received: from 209-6-91-204.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com (HELO
	jerusalem.litteratus.org.litteratus.org) ([209.6.91.204])
	by smtp01.lnh.mail.rcn.net with ESMTP; 08 Apr 2010 12:35:35 -0400
From: Robert Huff <roberthuff@rcn.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <19390.1494.857240.45869@jerusalem.litteratus.org>
Date: Thu, 8 Apr 2010 12:35:34 -0400
To: ipfw@freebsd.org
In-Reply-To: <y2m6201873e1004080857q79d0ab30r93d1e5e8bb30d2b8@mail.gmail.com>
References: <201004080252.o382qFH7019790@leka.aloha.com>
	<x2m6201873e1004072052u88a62b4eo7d1e9a457240937a@mail.gmail.com>
	<19389.23404.649946.265403@jerusalem.litteratus.org>
	<o2s6201873e1004072155ie746928cx5faac5d3f8e1d8ef@mail.gmail.com>
	<19389.51130.108457.400747@jerusalem.litteratus.org>
	<y2m6201873e1004080857q79d0ab30r93d1e5e8bb30d2b8@mail.gmail.com>
X-Mailer: VM 7.17 under 21.5  (beta28) "fuki" XEmacs Lucid
X-Junkmail-Whitelist: YES (by domain whitelist at mr02.lnh.mail.rcn.net)
Cc: 
Subject: Re: Kernel Config for NAT
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Apr 2010 16:35:37 -0000


	I am planning to a) update a -CURRENT system to recent code,
and b) install ipfw+NAT.
	The documentation in the Handbook is confusing and/or
incomplete.  So far I have:

1) in /boot/loader.conf:

ipfw_load="YES"
ipdivert_load="YES"

2) in the kernel config:

#options  IPFIREWALL              #firewall
#options  IPFIREWALL_VERBOSE      #enable logging to syslogd(8)
#options  IPFIREWALL_VERBOSE_LIMIT=100    #limit verbosity
#options  IPFIREWALL_DEFAULT_TO_ACCEPT    #allow everything by default
#options  IPDIVERT
#options  IPFIREWALL_NAT          #ipfw kernel nat support
options  LIBALIAS                               # required for NAT

3) in /etc/sysctl.conf:

net.inet.ip.fw.default_to_accept="1"
net.inet.ip.fw.verbose="1"
net.inet.ip.fw.verbose_limit="100

	Is there anything else I need?  (Assume I have a working set of
firewall rules.)
	Is there anything I need to take out?

	Respectfully,


				Robert Huff