From owner-freebsd-ipfw  Tue Jun 13  9:53:51 2000
Delivered-To: freebsd-ipfw@freebsd.org
Received: from post.xecu.net (post.xecu.net [216.127.136.211])
	by hub.freebsd.org (Postfix) with ESMTP id 3A52C37BFA5
	for <freebsd-ipfw@FreeBSD.ORG>; Tue, 13 Jun 2000 09:53:43 -0700 (PDT)
	(envelope-from andy@xecu.net)
Received: from shell.xecu.net (shell.xecu.net [216.127.136.216])
	by post.xecu.net (Postfix) with ESMTP
	id CDF64487B; Tue, 13 Jun 2000 12:51:30 -0400 (EDT)
Received: from localhost (andy@localhost)
	by shell.xecu.net (8.8.8+Sun/8.8.8) with ESMTP id MAA25061;
	Tue, 13 Jun 2000 12:53:30 -0400 (EDT)
X-Authentication-Warning: shell.xecu.net: andy owned process doing -bs
Date: Tue, 13 Jun 2000 12:53:30 -0400 (EDT)
From: Andy Dills <andy@xecu.net>
To: cjclark@alum.mit.edu
Cc: "purpledreams.com system administrator" <super@purpledreams.com>,
	freebsd-ipfw@FreeBSD.ORG
Subject: Re: Hijacking DNS with ipfw
In-Reply-To: <20000610121626.A1197@dialin-client.earthlink.net>
Message-ID: <Pine.GSO.4.21.0006121047220.8612-100000@shell.xecu.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-ipfw@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On Sat, 10 Jun 2000, Crist J. Clark wrote:

> On Sat, Jun 10, 2000 at 12:30:23PM -0400, Andy Dills wrote:
> 
> [snip]
> 
> > The problem is, AFAIK nat will not do that under any circumstances. I
> > tried this approach already:
> > 
> > (I'm running on instance of natd on 8668 already. According to the manpage
> > for natd, -reverse is the closest approximation to what I'm trying to do)
> > 
> > natd -p 8669 -alias_address <primary ip of inside card> -reverse
> > ipfw add 10 divert 8669 udp from any to any 53 via xl1
> > ipfw add 11 fwd 127.0.0.1,53 udp from <ip from the natd command> to any 53
> > 
> > That's the only way I can think of to do this with nat, and that didn't
> > work either.
> 
> Shouldn't this be,
> 
>   # cat /etc/natd_dns.conf  # command line for natd getting long
>   port 8669
>   interface xl1
>   reverse
>   redirect_address <internal IP> 0.0.0.0
>   # natd -f /etc/natd_dns.conf
>   # ipfw add 10 divert 8669 udp from any to any 53 via xl1
>   # ipfw add 11 divert 8669 tcp from any to any 53 via xl1

FWIW, this still didn't do the trick. Because the method I originally
wanted to use worked fine for http, I'm 99% sure the source of the problem
is with named. I'm off to beat on those bushes, to see if the bind
developers can explain it.

Andy

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Andy Dills                              301-682-9972
Xecunet, LLC                            www.xecu.net
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Dialup * Webhosting * E-Commerce * High-Speed Access





To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message