Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 4 May 2026 12:50:18 -0400
From:      Karl Denninger <karl@denninger.net>
To:        freebsd-ipfw@freebsd.org
Subject:   Re: NAT problems 14.3+
Message-ID:  <51a4773f-25d7-406b-b1b1-d738fd97ae8e@denninger.net>
In-Reply-To: <2F1D9FC8-81BA-484D-B7B0-DE94A22392CC@connectedserver.com>
References:  <27FFB189-7608-4A97-AD87-21EC64CBC975@connectedserver.com> <30c2d1b4-d96e-4e25-b2d9-264fdcda2d7e@yandex.ru> <FCC37B22-A051-40B3-BEA0-5458064FCBBF@connectedserver.com> <09e445e7-bea5-41cb-9ffc-9e1268a142de@yandex.ru> <1614DF5F-C565-40AA-A85C-F52A9B9FAA3B@connectedserver.com> <56621F4A-0FDC-4772-BB3B-A68F5230C63B@connectedserver.com> <2F1D9FC8-81BA-484D-B7B0-DE94A22392CC@connectedserver.com>
index | next in thread | previous in thread | raw e-mail 

[-- Attachment #1 --]
n 5/4/2026 10:28, Rob Bloemers wrote:
> FWIW
>
> Avoiding in-kernel IPFW NAT and using the rc.firewall / type open with natd in userspace, nat seems to function fine for my jails.
>
>> On 3 May 2026, at 12:54, Rob Bloemers <bsd@connectedserver.com> wrote:
>>
>> I've tried this setup now on three different machines at three different providers, and each time my simple NAT breaks and i'm still clueless on the why. And it prevents me from moving quite a few machines from 14.3 to newer releases. What works fine on 14.3 breaks on 14.4 or newer, which even worse results on 15.0. Even the ipfw nat example from the freebsd manual does not work. I'm sure i cant be the only one with this issue?
>>
>> Really hope somebody can replicate this for him/herself to confirm this and/or give me a solution for my problem.
>>
>> Kind Regards
>> Rob

Precisely what is not working on 14.4?  I've missed some of this but 
that message caught my eye.

I ask because:

FreeBSD 14.4-STABLE (GENERIC) #0 stable/14-n273840-e5ed09ffd592-dirty: 
Thu Mar 26 14:22:11 EDT 2026

IpGW External gateway

And I am using in-kernel ipfw NAT (config file is in 
/usr/local/etc/ipfw.local and is quite-extensive as the configuration 
here is a bit complex):

...

#
# Set up interfaces and set abbreviations
#
iif="ix1"
oif="ix0"
pubif="ix1.3"
#
# Declare networks
# First, all internal addresses are on 192.168.0.0/16.
#
inet="192.168.0.0/16"

# Reassemble UDP packets before continuing so fragmented ones work
#
         ${fwcmd} add 50 reass all from any to any in
....

         ${fwcmd} nat 100 config if ${oif} log same_ports reset 
redirect_port ......(many)

....

#
# Now pick up all *outbound* packets that originated from an inside address
# (including IPSEC tunneled stuff) and put them through NAT.  We then have
# a packet with a local source address and we can allow it to be sent.
# Therefore, if the packet is outbound let it pass and be done with it.
#
         ${fwcmd} add 8002 nat 100 ip4 from 192.168.0.0/16 to any xmit 
${oif}
         ${fwcmd} add 8006 deny log ip4 from 192.168.0.0/16 to any xmit 
${oif}

All works as expected and when I went from 14.3 -> 14.4 I did not have 
to make any adjustments.

I've not yet moved to 15.x on this box but will somewhere in the 
not-so-distant future.

-- 
Karl Denninger
karl@denninger.net
/The Market Ticker/
/[S/MIME encrypted email preferred]/

[-- Attachment #2 --]
0	*H
010
	`He0	*H
00YSJtDU/NxCи0
	*H
0v10	UUS10U	Tennessee10U

Denninger.Net10UDenninger Root1"0 	*H
	admin@denninger.net0
240509210803Z
440504210803Z0]10	UUS10U	Tennessee10U

Denninger.net1"0 UDenninger.Net Signing Int0"0
	*H
0
GKRsߣטCߺMQOH%qj-"r$I'Ǣ"s~]*x!Ήk%=s)dZsOpb'03bg<vn1Llj֠|wUp.~'Ġ)˿ί.
ഈC~6d*{_[|Myfؔ<~8awMvuxLaQjmjS2HG,g?j=L	Ji6020UnxAŢ@BzL$a.0U#0DV➋Kߏpɡzx0v10	UUS10U	Tennessee10U

Denninger.Net10UDenninger Root1"0 	*H
	admin@denninger.netA"խB6~0U00U0:U3010/-+)http://www.denninger.net/root-revoked.crl0
	*H
|V=6rRq?Ѓ/@vfN!<ث<S4lS8'Z&AjHM3R+/2T.@(I֩1oVYGrgߢro-x.y NL"QBBQsk8u[W,Vޅ~á®/)pP}i{7mh̨$W,2x-+v0-/-Ys*4p6!Fd-L`ZFR~3Ɏ#ZSJz5-	KS5'1"kUީq0f_DMC&u)N3HJWQ`a[y;uTg?eR?(ܗvEQs?O).Snq
8DXPX3+s飞s3%4F!R0B%ٕ\mUH۶HFXuOUiܨ`M	'H00Ѡm
 ?ش<0
	*H
0]10	UUS10U	Tennessee10U

Denninger.net1"0 UDenninger.Net Signing Int0
240510192659Z
290509192659Z0W10	UUS10U	Tennessee10U
Karl Denninger10Ukarl@denninger.net0"0
	*H
0
T[I-ΆϏdn;Å@שy.us~_ZG%<MYd\gvfnsa1'6Egyjs"C [{~_KPn+<*pv#Q+H/7[-vqDV^U>f%GX)H.|l`M(Cr>е͇6#odc"YljҦln8@5SA0&ۖ"OGj?UDWZ5	dDB7k-)9Izs-JAv
J6L$Ն1SmY.Lqw*SH;EF'DĦH]MOgQQ|Mٙג2Z9y@y]}6ٽeY9Y2xˆ$T=eCǺǵbn֛{j|@LLt1[Dk5:$=	`	M00:+.0,0*+0http://ocsp.denninger.net:77770U00U0U%0++03	`HB
&$OpenSSL Generated Client Certificate0U%՞V=؁;bzQ0U#0nxAŢ@BzL$a.zx0v10	UUS10U	Tennessee10U

Denninger.Net10UDenninger Root1"0 	*H
	admin@denninger.netYSJtDU/NxCи0U0karl@denninger.net0
	*H
N8A7t-!w{Fq"66!<R1\	uDE87,-my6˹,)mKh^+3_;ܰ"|yWy>r(3P&d1a$׎&u*<<ت
i'SDJp)Ss0X;ZB6S(s`[ƅK"7L+X{Tk,1w100t0]10	UUS10U	Tennessee10U

Denninger.net1"0 UDenninger.Net Signing Intm
 ?ش<0
	`He0	*H
	1	*H
0	*H
	1
260504165018Z0O	*H
	1B@șD|Y&2/E"&@<o^z?-o\Y0	+71v0t0]10	UUS10U	Tennessee10U

Denninger.net1"0 UDenninger.Net Signing Intm
 ?ش<0*H
	1vt0]10	UUS10U	Tennessee10U

Denninger.net1"0 UDenninger.Net Signing Intm
 ?ش<0W	*H
	1H0D0	`He*0	`He0
*H
0
*H
0
*H
0+0
*H
0+0	`He0	`He0	`He0	`He0	`He0	`He0	`He	0	`He
0	*H
0	+H?0+0+0+0+0	+H?0+0+0+0+0
	*H
UvگA g?,mt	8E3gL\A^0E`e[It27׈u5Bf)
2ߜ#)<tg=h]4\cXZ'BԎkQ06`=@!Ep0OVE_9Uta2Fc
lg_R,f-D
͗[b|nAʕ5J7XKΟ
`50w<y(`y$_[mE(Gܖ)_YIG5BjY_<!
Ꮉ#ͷ7u"TPY x<2L&îߖ
*KM1jegC{0">}+ASxTBY_K
[B`#)nAbXA%TYsLU+Xs6ۖЈV<nt`klr1
g5NgM[<Hi
home | help

Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?51a4773f-25d7-406b-b1b1-d738fd97ae8e>