From owner-freebsd-security@FreeBSD.ORG Fri May 13 06:35:18 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5237B16A4CE for ; Fri, 13 May 2005 06:35:18 +0000 (GMT) Received: from mail.duth.gr (mail.duth.gr [192.108.114.110]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7ED9E43D3F for ; Fri, 13 May 2005 06:35:17 +0000 (GMT) (envelope-from bigbrother@bonbon.net) Received: from bigb3server.ath.cx (b9-29.xan.duth.gr [193.92.211.29]) by mail.duth.gr (8.13.1/8.13.1) with ESMTP id j4D6ZA9m030432 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 13 May 2005 09:35:15 +0300 (EEST) (envelope-from bigbrother@bonbon.net) Received: from bigb3server.bbcluster.gr (localhost [127.0.0.1]) by bigb3server.ath.cx (8.13.1/8.13.1) with ESMTP id j4D6X8mC087312 for ; Fri, 13 May 2005 09:33:08 +0300 (EEST) (envelope-from bigbrother@bonbon.net) Received: from localhost (bigbrother@localhost)j4D6X8Au087309 for ; Fri, 13 May 2005 09:33:08 +0300 (EEST) (envelope-from bigbrother@bonbon.net) X-Authentication-Warning: bigb3server.bbcluster.gr: bigbrother owned process doing -bs Date: Fri, 13 May 2005 09:33:08 +0300 (EEST) From: BigBrother-{BigB3} Cc: freebsd-security@freebsd.org In-Reply-To: <1682287017.20050513100245@625.ru> Message-ID: <20050513092907.J73276@bigb3server.bbcluster.gr> References: 6667 <20050511205723.48284.qmail@web41210.mail.yahoo.com> <1682287017.20050513100245@625.ru> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Scanned-By: MIMEDefang 2.51 on 192.108.114.110 X-Greylist: Sender DNS name whitelisted, not delayed by milter-greylist-1.6 (mail.duth.gr [192.108.114.110]); Fri, 13 May 2005 09:35:15 +0300 (EEST) X-Mailman-Approved-At: Fri, 13 May 2005 13:05:03 +0000 Subject: Re[2]: icmp problem X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 May 2005 06:35:18 -0000 On Fri, 13 May 2005, Danil V. Gerun wrote: > > AW> I would guess, that ICMP packets do not have a port number (just a > AW> request/response id), so that the NAT cannot distinguish multiple > AW> ICMP packet sources (I mean: The response from the ICMP requestee > AW> cannot be mapped back to the appropriate ICMP requester). > > AW> Hmm... I just think, that (if you have multiple ICMP requestees) > AW> the NAT could be able to map back the ICMP requester IP by the IP > AW> of the ICMP requestee. But I do not know, how your router works... > > AW> Maybe your computer-pool could elect an ICMP-master, who > AW> coordinates all the ICMP traffic through the NAT. > > AW> Bye > AW> Arne > > In my NATED (ipfw+natd) lan EVERY internal host (192.168.XX) can ping simultaneously any external host and ALL getting their proper ICMP replies. If you have a straightforward setup you wont have any problems. Just try a simple test...Run ipfw with one divert rule only, and the "natd" application and see what happens if you ping. I think that you are using some limiters in your ipfw rules. Rgz, BB --- Dreams have no limits!