Date: Sun, 21 Jan 2001 17:26:52 -0800 (PST) From: Ian Kallen <spidaman@arachna.com> To: freebsd-hackers@freebsd.org Subject: Re: accessing an outside IP from inside a NAT net Message-ID: <Pine.BSF.4.10.10101211711100.7087-100000@along-came-a-spider.arachna.com> In-Reply-To: <Pine.BSF.4.10.10101190014250.50099-100000@along-came-a-spider.arachna.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Since I hate finding unanswered questions in the archive, I'm posting the resolution. The previous answers that suggested subnetting the internal network and setting up additional port diversions for the webserver in the firewall rules didn't do it, certainly not in combination. However, setting up another port diversion for natd on the internal network did the trick. The external net NIC is using the ed driver, the internal ep, so the firewall rules now simply have # wipe the slate /sbin/ipfw -f flush # outside net /sbin/ipfw add divert natd all from any to any via ed0 # inside net, this is what needed to be added /sbin/ipfw add divert natd all from any to any via ep0 # whatever other specific packet processing rules... /sbin/ipfw add pass all from any to any I had to poke around at natd and ipfw a whole lot to arrive at this conclusion, IMO the additional rule for the internal net should be in the example rc.firewall and/or in the /usr/share/examples/etc examples. cheers, -Ian -- Ian Kallen <spidaman@arachna.com> | AIM: iankallen | efax: (415) 354-3326 On Fri, 19 Jan 2001, Ian Kallen wrote: > > I'd like a hand figuring out how to access resources on the internal side > of a NAT net from within it without doing something kludgey with DNS. > i.e. suppose I run natd with a configuration like this: > > # begin /etc/natd.conf > use_sockets > same_ports > port 8668 > deny_incoming no > log > redirect_port tcp 10.0.0.128:80 206.169.18.10:80 > # end /etc/natd.conf > > Now if the DNS for the web server www.foo.com running on 10.0.0.128 > directs a browser on the 10.0.0.0 net to 206.169.18.10, it doesn't get > routed back to 10.0.0.128; it just hangs (I'm acutally not sure what's > happening there, the connction never succeeds). Is there a nice way to > handle this case without running a dummy DNS just for the 10.0.0.0 > internal net? > > thanks, > -Ian > > -- > Ian Kallen <spidaman@arachna.com> | AIM: iankallen | efax: (415) 354-3326 > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-hackers" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.10.10101211711100.7087-100000>