Date: Wed, 9 Mar 2016 10:17:11 -0800 From: Freddie Cash <fjwcash@gmail.com> To: Don Lewis <truckman@freebsd.org> Cc: "freebsd-ipfw@freebsd.org" <freebsd-ipfw@freebsd.org> Subject: Re: ipwf dummynet vs. kernel NAT and firewall rules Message-ID: <CAOjFWZ5=ffj-mHWDvmsc=JDVSKc8Ttck-Ukg-RqUpuOcUsTdOw@mail.gmail.com> In-Reply-To: <201603091809.u29I9PEv011156@gw.catspoiler.org> References: <DA540940-CED7-4E2E-8E1D-5088A140F2CB@lastsummer.de> <201603091809.u29I9PEv011156@gw.catspoiler.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Mar 9, 2016 at 10:09 AM, Don Lewis <truckman@freebsd.org> wrote: > On 9 Mar, Franco Fichtner wrote: > > Hi Don, > > > > If you mean pf(4)-based NAT, there is a patch that originates from > > m0n0wall that handles the transition. We're using it in OPNsense > > for that reason. Here is the patch for 10.x, maybe that is what > > you're looking for: > > Nope, I'm using ipfw in-kernel NAT, which is not the default in > rc.firewall, but is easy to paste in next to or in place of the default > natd configuration. > > case ${firewall_nat_enable} in > [Yy][Ee][Ss]) > if [ -n "${firewall_nat_interface}" ]; then > if echo "${firewall_nat_interface}" | \ > grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; the= n > firewall_nat_flags=3D"ip > ${firewall_nat_interface} ${firewall_nat_flags}" > else > firewall_nat_flags=3D"if > ${firewall_nat_interface} ${firewall_nat_flags}" > fi > ${fwcmd} nat 123 config log ${firewall_nat_flags} > ${fwcmd} add nat 123 ip4 from any to any via > ${firewall_nat_interface} > fi > ;; > esac > > My suspicion is that if a packet matches the rule to pass it to dummynet > that it is bypassing NAT. > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" > =E2=80=8BDo you have the sysctl net.inet.ip.fw.one_pass set to 0 or 1? If set to 1, the a dummynet match ends the trip through the rules, and the packet never gets to the NAT rules. Or, if a NAT rule matches, the trip through the rules ends, and it never get to the dummynet rules. Depending on which you have first. You'll need to set net.inet.ip.fw.one_pass=E2=80=8B=3D0 in order to re-inje= ct the packet into the rules after it matches a dummynet or NAT rule. Or, do the NAT and dummynet rules on different interfaces to match different traffic. --=20 Freddie Cash fjwcash@gmail.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAOjFWZ5=ffj-mHWDvmsc=JDVSKc8Ttck-Ukg-RqUpuOcUsTdOw>