From owner-freebsd-questions  Mon Jan  6  5: 7:59 2003
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5133937B401
	for <freebsd-questions@FreeBSD.ORG>; Mon,  6 Jan 2003 05:07:58 -0800 (PST)
Received: from mail.asni.rsu.ru (mail.asni.rsu.ru [195.208.251.195])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C9B6243ED4
	for <freebsd-questions@FreeBSD.ORG>; Mon,  6 Jan 2003 05:07:56 -0800 (PST)
	(envelope-from ReSerg@Mail.Ru)
Received: from h7.asni.rsu.ru (h7.asni.rsu.ru [195.208.251.207])
	by mail.asni.rsu.ru (8.11.1/8.11.1) with ESMTP id h06DBQ803830
	for <freebsd-questions@FreeBSD.ORG>; Mon, 6 Jan 2003 16:11:26 +0300 (MSK)
	(envelope-from ReSerg@Mail.Ru)
Date: Mon, 6 Jan 2003 16:07:20 +0300
From: Serg Repalov <ReSerg@Mail.Ru>
X-Mailer: The Bat! (v1.61)
Organization: rsu
X-Priority: 3 (Normal)
Message-ID: <1737194525.20030106160720@Mail.Ru>>
To: freebsd-questions@FreeBSD.ORG
Subject: question about /etc/rc.firewall
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

Hi.

  Can anyone make clear for me one thing. In file /etc/rc.firewall
we have two sections which stops RFC1918 and draft-manning-dsua-03.txt
networks:
  # Stop RFC1918 nets on the outside interface
  [ ... ]

  # Network Address Translation.  This rule is placed here deliberately
  [ ... ]
  case ${natd_enable} in
  [Yy][Ee][Ss])
      if [ -n "${natd_interface}" ]; then
         ${fwcmd} add divert natd all from any to any via ${natd_interface}
      fi
      ;;
  esac

  # Stop RFC1918 nets on the outside interface
  [ ... ]

If we don't using NAT then we have _two_ sections of _same_ rules,
where the second sections is unnecessary. May be better code is:
  # Stop RFC1918 nets on the outside interface
  [ ... ]

  # Network Address Translation.  This rule is placed here deliberately
  [ ... ]
  case ${natd_enable} in
  [Yy][Ee][Ss])
      if [ -n "${natd_interface}" ]; then
         ${fwcmd} add divert natd all from any to any via ${natd_interface}

         # Stop RFC1918 nets on the outside interface
         [ ... ]
      fi
      ;;
  esac

Where the second section which stops RFC1918 and draft-manning-dsua-03.txt
networks is applied only if we really using NAT ?


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message