From owner-freebsd-net@freebsd.org  Sun Dec 17 18:42:49 2017
Return-Path: <owner-freebsd-net@freebsd.org>
Delivered-To: freebsd-net@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 48296E91C23;
 Sun, 17 Dec 2017 18:42:49 +0000 (UTC)
 (envelope-from eugen@grosbein.net)
Received: from hz.grosbein.net (hz.grosbein.net [78.47.246.247])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "hz.grosbein.net", Issuer "hz.grosbein.net" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id B04AB79B9D;
 Sun, 17 Dec 2017 18:42:47 +0000 (UTC)
 (envelope-from eugen@grosbein.net)
Received: from eg.sd.rdtc.ru (root@eg.sd.rdtc.ru [62.231.161.221] (may be
 forged))
 by hz.grosbein.net (8.15.2/8.15.2) with ESMTPS id vBHIgXNO069873
 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT);
 Sun, 17 Dec 2017 19:42:33 +0100 (CET)
 (envelope-from eugen@grosbein.net)
X-Envelope-From: eugen@grosbein.net
X-Envelope-To: sodynet1@gmail.com
Received: from [10.58.0.4] (dadv@[10.58.0.4])
 by eg.sd.rdtc.ru (8.15.2/8.15.2) with ESMTPS id vBHIgOV7039505
 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT);
 Mon, 18 Dec 2017 01:42:25 +0700 (+07)
 (envelope-from eugen@grosbein.net)
Subject: Re: need help using ng_patch to modify src/dst packets or alternative
 way
To: Sami Halabi <sodynet1@gmail.com>
References: <CAEW+ogbYXwMZUmbd+pmhgNPY-_7ZYHF4EeOWYgq+0iuG_hr2Mw@mail.gmail.com>
 <CAEW+ogae4BfmzSk4QU+4EHGE4E1BKO-mq2BAm1dvXCuh8DCYTg@mail.gmail.com>
 <CAEW+ogZfrmj-ZJoCp_WExc5K4Gck-yFBUo5q+jJ6Wao3LygXmQ@mail.gmail.com>
 <CAEW+ogYtdg2xUtyfWSLCwhyOypY-DT6c=BzOszcTMrCacp8jsQ@mail.gmail.com>
 <CAEW+ogbJU5qtNsENkMA8-=kV8BsOMhP4biEsxtLfr-t54NE4=g@mail.gmail.com>
 <CAEW+ogYzjpMzWSTxNDtKvEQgo3HpzuCgDh6Vs5_EKxM+CfGWtg@mail.gmail.com>
 <CAEW+ogZpBhMpfZpRJa3LR_yzgeFWSRZhezaeVZ6JmYcoDy6xQg@mail.gmail.com>
 <CAEW+ogZukjbh2zqcMWzc7R1zVzwyGiLfG=JZeZdcJbana5jhDg@mail.gmail.com>
 <CAEW+ogbOVzpeDkDrWgDud8ttUVSPuaOEJ_Dw+QxfshZ4zTSVKQ@mail.gmail.com>
 <CAEW+ogbaR=k1H2_1MYXjHCEKTFUYCo5k9cn-fOm3bT5VJaQpGg@mail.gmail.com>
 <CAEW+ogZ1-R97P6MhECcLYjdKr4ZFKUhnuMvk7r2eN2F8-E1LNA@mail.gmail.com>
 <CAEW+ogaxHp387AZGBBHQChz4VP5pH-TW9eCFGd2YeW_fcuVVSA@mail.gmail.com>
 <5A3638E5.6090308@grosbein.net>
 <CAEW+ogY8erHN=ZnKCqxxVx8Ww=2eVL4bm1CtMXyZhESTzM-SXA@mail.gmail.com>
Cc: freebsd-net@freebsd.org, FreeBSD Current <freebsd-current@freebsd.org>
From: Eugene Grosbein <eugen@grosbein.net>
Message-ID: <5A36BA90.8020302@grosbein.net>
Date: Mon, 18 Dec 2017 01:42:24 +0700
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.7.2
MIME-Version: 1.0
In-Reply-To: <CAEW+ogY8erHN=ZnKCqxxVx8Ww=2eVL4bm1CtMXyZhESTzM-SXA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Spam-Status: No, score=2.2 required=5.0 tests=BAYES_00, LOCAL_FROM, RDNS_NONE
 autolearn=no autolearn_force=no version=3.4.1
X-Spam-Report: * -2.3 BAYES_00 BODY: Bayes spam probability is 0 to 1%
 *      [score: 0.0000] *  2.6 LOCAL_FROM From my domains
 *  1.9 RDNS_NONE Delivered to internal network by a host with no rDNS
X-Spam-Level: **
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on hz.grosbein.net
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.25
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 17 Dec 2017 18:42:49 -0000

17.12.2017 17:59, Sami Halabi wrote:

> Hi Eugene,
> I'm looking for a solution for IP traffic. in linux iptables its possible but I couldn't find freebsd way yet.
> bkuncr soulution works for tcp only.

Then, you need to realize that for every packet, you need to change (translate)
both of source IP address from 10.1.1.2 to 1.1.1.1 and destination IP address
from 10.1.1.1 to X.X.X.X. This is called network address translation and,
in fact, you need NAT. But not ordinary "simple" NAT that translates
only source address in outgoing packets (and destination in incoming replies)
but double or "binat" to translate destination address in outgoing packets too
(and source address in corresponding replies).

This is possible to do with two instances of "ipfw nat" (or natd) for single external destination
but not for arbitrary number of external destinations.

They say, "pf(4)" packet filter can perform "binat" properly.
I have not tried that. You should start reading its documentation.