From owner-freebsd-ipfw  Tue Jul 16  4:30:52 2002
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 1A53E37B400; Tue, 16 Jul 2002 04:30:50 -0700 (PDT)
Received: from xy.blank.spb.ru (xy.blank.spb.ru [194.67.6.187])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 017D443E67; Tue, 16 Jul 2002 04:30:49 -0700 (PDT)
	(envelope-from borman@blank.spb.ru)
Received: from xy.blank.spb.ru (localhost.blank.spb.ru [127.0.0.1])
	by xy.blank.spb.ru (8.12.3/8.12.3/blank) with ESMTP id g6GBUlKj005105;
	Tue, 16 Jul 2002 15:30:47 +0400 (MSD)
	(envelope-from borman@xy.blank.spb.ru)
Received: (from borman@localhost)
	by xy.blank.spb.ru (8.12.3/8.12.3/Submit) id g6GBUlCA005104;
	Tue, 16 Jul 2002 15:30:47 +0400 (MSD)
Date: Tue, 16 Jul 2002 15:30:47 +0400
From: boris karlov <borman@blank.spb.ru>
To: ipfw@FreeBSD.ORG
Cc: Ruslan Ermilov <ru@FreeBSD.ORG>
Subject: Re: keep-state rule before nat
Message-ID: <20020716113047.GC4470@xy.blank.spb.ru>
References: <3C6A38F2.8B65E6EC@jet.msk.su> <20020213105807.B46245@sunbay.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <20020213105807.B46245@sunbay.com>
User-Agent: Mutt/1.4i
Sender: owner-freebsd-ipfw@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-ipfw.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-ipfw>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-ipfw>
X-Loop: FreeBSD.ORG

On Wed, 13 Feb 2002 10:58:07 +0200, Ruslan Ermilov <ru@FreeBSD.ORG> wrote:
> On Wed, Feb 13, 2002 at 11:59:14AM +0200, Andrew V. Jemerya wrote:
> > Hi, guys!
> > 
> > I had some trouble with keep-state rules recently.
> > My firewall rules are the folowing:
> > 
> > check-state
> > allow tcp from any to xxxx 25 keep-state
> > allow udp from any 53 to xxx 53 keep-state
> > 
> > divert natd from 192.168.0.0/24 to any out via rl0
> > divert from any to xxx in via rl0
> > 
> > 
> > allow all from 192.168.0.4 to any via rl1 keep-state
> > 
> > This construction doen't work properly, but exactly it doesn't work at
> > all
> > What can I do for this situation?
> > 
> Keep-state combined with divert is really tricky.
> Search ML archives for a possible solution.  I
> posted them once.
> 

-- Alas, I can't find smth. appropriate in ML archives. I've failed with
Google too.
Does anybody have a recipe? URL or paper?

Finally I can't realize which rules I get from `keep-state' match in this
case.

10x in advance,
boris karlov.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message