Date: Mon, 8 Jul 2019 10:17:19 -0700 From: Michael Sierchio <kudzu@tenebras.com> To: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org> Subject: Re: How to set up ipfw(8) NAT between an alias and the main IP address, when the alias is in another network? Message-ID: <CAHu1Y711JVCo2koCivAbduFp42ddL1eHfTdNBK6qqPeGwGUftw@mail.gmail.com> In-Reply-To: <8e388abc-f2ac-b070-cf86-a4d3971ac095@rawbw.com> References: <8e388abc-f2ac-b070-cf86-a4d3971ac095@rawbw.com>
next in thread | previous in thread | raw e-mail | index | archive | help
NAT is already maintaining state =E2=80=93 it is possible to combine statef=
ul rules
and NAT, but don't. ;-)
Are you really proposing to NAT twice, or is 192.168.1.2 a phony address
for the purposes of discussion here?
In any case, consider something like the following:
#!/bin/sh
fw=3D"/sbin/ipfw -q"
sysctl net.inet.ip.fw.one_pass=3D0
IP_JAIL=3D"192.168.100.2"
IP_EXIF=3D"192.168.1.2"
OIF=3D"sk0"
###########################################################################=
#####
# If 192.168.1.2 is really your interface address, you'll be nat'ing twice
# on the way to the internet, which is ugly. You don't need the *unreg_only=
*
# directive if you only have RFC1918 addresses anyway. You should clarify
# if this is the case. *reset* kills all active nat sessions if you run thi=
s
# script again.
$fw flush
$fw nat 1 config \
redirect_addr ${IP_EXIF} ${IP_JAIL} \
redirect_addr ${IP_JAIL} ${IP_EXIF} \
if ${OIF} unreg_only reset
###########################################################################=
#####
# separate in and out as a matter of habit - don't mention protocol in nat
# statement, do this in subsequent rules
$fw add 01000 nat 1 ip from any to any in recv ${OIF}
# check-state isn't needed, really, since it gets performed at the next
# rule that mentions state
#$#$#$#$# $fw add 01500 check-state
# these will match traffic to/from external IP and not jail
$fw add 02000 allow tcp from ${IP_EXIF} to any out setup keep-state
$fw add 02010 allow udp from ${IP_EXIF} to any out keep-state
$fw add 02020 allow icmp from ${IP_EXIF} to any out keep-state
###########################################################################=
#####
# Why is this safe? because it will only match NAT return packets.
# It only permits traffic to your jail in this case. Also, for TCP to
# function properly, to need to accept ICMP error messages, esp. need-frag
$fw add 02000 allow ip from any to ${IP_JAIL}
###########################################################################=
#####
# outbound packets pass through nat
$fw add 03000 nat 1 ip from any to any out xmit ${OIF}
###########################################################################=
#####
# if your default rule (65535) is DENY, you need something like this. This
will
# match only NAT'd traffic
$fw add 50000 allow ip from any to any out xmit ${OIF}
On Sat, Jul 6, 2019 at 1:03 AM Yuri <yuri@rawbw.com> wrote:
> My network interface looks like this:
>
> sk0: flags=3D8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 15=
00
> options=3D80009<RXCSUM,VLAN_MTU,LINKSTATE>
> ether 01:3c:47:8a:17:12
> inet 192.168.1.2 netmask 0xffffff00 broadcast 192.168.1.255
> inet 192.168.100.2 netmask 0xffffffff broadcast 192.168.100.2
> media: Ethernet autoselect (100baseTX <full-duplex>)
> status: active
> nd6 options=3D29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
>
> The second IP address is an alias that is used for jail.
>
> I would like to set up NAT so that this jail would access the internet
> through the same interface.
>
>
> I tried this script:
>
>
> fw=3D"/sbin/ipfw -q"
>
> $fw nat 1 config redirect_addr 192.168.100.2 192.168.1.2 redirect_addr
> 192.168.1.2 192.168.100.2 if sk0 unreg_only reset
>
> $fw add 1001 nat 1 tcp from 192.168.100.2/32 to any via sk0 keep-state
>
> $fw add 1002 check-state
>
>
> The rule 1001 has keep-state, therefore it should process both outgoing
> tcp and incoming response packets. But the outbound packets are NATted,
> but the inbound ones are not.
>
> What is wrong, and how to fix this script?
>
>
> Thank you,
>
> Yuri
>
>
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
>
--=20
"Well," Brahm=C4=81 said, "even after ten thousand explanations, a fool is =
no
wiser, but an intelligent person requires only two thousand five hundred."
- The Mah=C4=81bh=C4=81rata
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAHu1Y711JVCo2koCivAbduFp42ddL1eHfTdNBK6qqPeGwGUftw>