From owner-freebsd-questions Mon Sep 30 9:19:54 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 05E7637B401 for ; Mon, 30 Sep 2002 09:19:53 -0700 (PDT) Received: from kepa.kepa.fi (kepa.kepa.fi [62.142.22.194]) by mx1.FreeBSD.org (Postfix) with ESMTP id D4C4843E6A for ; Mon, 30 Sep 2002 09:19:51 -0700 (PDT) (envelope-from www-data@kepa.fi) Received: from mail.kepa.fi (mail.kepa.fi [62.142.22.201]) by kepa.kepa.fi (8.12.3/8.12.3) with ESMTP id g8UGJnMY092847 for ; Mon, 30 Sep 2002 19:19:49 +0300 (EEST) (envelope-from www-data@kepa.fi) Received: from www-data by mail.kepa.fi with local (Exim 3.35 #1 (Debian)) id 17w3DU-00017w-00 for ; Mon, 30 Sep 2002 19:16:16 +0300 To: freebsd-questions@freebsd.org Subject: Puzzling NATD problem Message-ID: <1033402576.3d9878d09bfa2@mail.kepa.fi> Date: Mon, 30 Sep 2002 19:16:16 +0300 (EEST) From: Kim Helenius MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.6 X-Originating-IP: 62.248.242.60 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG The setting: Network topology: Internet---Campus Network---FreeBSD NATD machine---Internal host A custom kernel build including the following options: options IPFIREWALL options IPDIVERT Used the command: sysctl net.inet.ip.forwarding=1 And started natd with natd -interface xl0 Then did, straight from the manpage, the following firewall rules: /sbin/ipfw -f flush /sbin/ipfw add divert natd all from any to any via xl0 /sbin/ipfw add pass all from any to any Now NAT works perfectly for the internal host, but (almost) all TCP connections cease to work to/from the NATD machine. AFAIK UDP and ICMP work perfectly. I've tried this on two different FreeBSD machines in the same network with identical results. If I remove the divert rule, everything works perfectly, except of course for the NAT. There have been no similar, puzzling effects on any Linux hosts I know of in the same network. I'm sure there's some knob I haven't pushed yet :) I'm aware this doesn't make much of a firewall but I'd like to get natd working before I run the firewall script. -- Kim Helenius kim.helenius@kepa.fi To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message