Date: Wed, 06 Aug 2003 00:27:02 +0200 From: Alex de Kruijff <freebsd@akruijff.dds.nl> To: Jacob Vennervald <jvennervald@proventum.net> Cc: freebsd-questions@FreeBSD.org Subject: Re: NATD and PPP problem Message-ID: <20030805222702.GA83123@dds.nl> In-Reply-To: <3F2FC71A.8040104@proventum.net> References: <3F2FC71A.8040104@proventum.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Aug 05, 2003 at 05:02:50PM +0200, Jacob Vennervald wrote: > Hi > > I've installed a FreeBSD 4.8 machine, which I wanna use as a > NAT/Router/Firewall. > I have setup the pppoe connection which works perfectly and then I've > tried to setup the machine as a NAT Router by setting the following in > the rc.conf: > firewall_enable="YES" > firewall_type="open" > natd_enable="YES" > natd_interface="tun0" > But when I restart the machine it gives me the following error: > "Firewall rules loaded, starting divert daemons: natdnatd: tun0: cannot > get interface address" > > When I log in and type "ifconfig" I can also see that the tun0 interface > doesn't exist, but when I turn off the two natd settings in rc.conf and > reboot it does exist. > > Can anybody help? > > Cheers, > Jacob Vennervald I assume you use ppp to setup your connection. If you don't this isn't going to work for you. You proberbly want to use the nat within the ppp tool instead. Try to leave the natd lines out of the rc.conf and add "nat enable yes" to this file: /etc/ppp/ppp.conf. Your gateway has internet afther this, but you lan doesn't. You must make sure that your firewall includes a line like: "divert 8668 ip from any to any via tun0". This send the packets to the natd port for processing. It could be that ipfw (the firewall) is called before ppp. This could cause it to ignore this rule. The best thing is to create a simple firewall with a script at first. Something like: ipfw flush ipfw add 100 allow ip from any to any via lo0 ipfw add 200 deny ip from any to 127.0.0.0/8 ipfw add 300 deny ip from 127.0.0.0/8 ipfw add 400 divert natd from any to any via tun0 ipfw add 500 allow ip from any to any And then execute it on the prompt like "script &". The & sign is importent if you didn't compile the kernel so that it allows all trafic by default. If your firewall denies all traffic by default then you may experiance a drop of you connection. Your script is aborted at this time, if it doesn't run in the bacground. -- Alex Articles based on solutions that I use: http://www.kruijff.org/alex/index.php?dir=docs/FreeBSD/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030805222702.GA83123>