From owner-freebsd-questions@FreeBSD.ORG Sun Dec 7 02:15:02 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 98FB016A4CE for ; Sun, 7 Dec 2003 02:15:02 -0800 (PST) Received: from garbage.relinfo.ru (garbage.relinfo.ru [195.161.208.151]) by mx1.FreeBSD.org (Postfix) with ESMTP id E6FC543FCB for ; Sun, 7 Dec 2003 02:15:00 -0800 (PST) (envelope-from levanty@mari-el.ru) Received: from lion.relinfo.ru ([195.161.208.133]) by garbage.relinfo.ru with esmtp (Exim 4.10) id 1ASvzw-00005A-00 for freebsd-questions@freebsd.org; Sun, 07 Dec 2003 13:18:44 +0300 Date: Sun, 7 Dec 2003 13:11:40 +0300 From: Lev Klimin X-Mailer: The Bat! (v1.61) Organization: VolgaTelecom X-Priority: 3 (Normal) Message-ID: <102409189483.20031207131140@mari-el.ru> To: freebsd-questions@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=Windows-1251 Content-Transfer-Encoding: 8bit Subject: natd & ipfw X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Lev Klimin List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Dec 2003 10:15:02 -0000 Good morning! I have 4.9-release. I'm interesting natd and ipfw. My tested box have two interface 172.16.0.10/29 and 195.161.208.210/30. # ifpw list 00500 divert 8668 ip from any to not 172.16.0.8/29 01000 allow ip from any to any # natd -v -a 195.161.208.210 When I ping 195.161.208.130 from machine behind firewall (172.16.0.9) I see. In [ICMP] [ICMP] 172.16.0.9 -> 195.161.208.130 8(0) aliased to [ICMP] 172.16.0.9 -> 195.161.208.130 8(0) Out [ICMP] [ICMP] 172.16.0.9 -> 195.161.208.130 8(0) aliased to [ICMP] 195.161.208.210 -> 195.161.208.130 8(0) ICMP packet flow through filter in two place: in ip_in and ip_out. It diverted to natd twice. Why in first it's source address doesn't change, but only in ip_out? If I do following 00500 divert 8668 ip from any to not 172.16.0.8/29 in then natd don't change source address, and ping don't work. I thinked that natd must do NAT whenever and wherever it work. May I be mistaken? Sorry for the trivial question, but I'm not a expert in FreeBSD, I'm only studying. Thank you. -- Lev Klimin mailto:levanty@mari-el.ru (8362) 42-15-49 19:37:26 2 декабря 2003 г.