From owner-freebsd-questions@FreeBSD.ORG  Thu Apr  8 12:10:35 2010
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id CF2AC106564A
	for <freebsd-questions@freebsd.org>;
	Thu,  8 Apr 2010 12:10:35 +0000 (UTC)
	(envelope-from roberthuff@rcn.com)
Received: from smtp02.lnh.mail.rcn.net (smtp02.lnh.mail.rcn.net
	[207.172.157.102])
	by mx1.freebsd.org (Postfix) with ESMTP id 8D2368FC08
	for <freebsd-questions@freebsd.org>;
	Thu,  8 Apr 2010 12:10:35 +0000 (UTC)
Received: from mr08.lnh.mail.rcn.net ([207.172.157.28])
	by smtp02.lnh.mail.rcn.net with ESMTP; 08 Apr 2010 08:10:35 -0400
Received: from smtp01.lnh.mail.rcn.net (smtp01.lnh.mail.rcn.net [207.172.4.11])
	by mr08.lnh.mail.rcn.net (MOS 3.10.8-GA) with ESMTP id LNH77083;
	Thu, 8 Apr 2010 08:10:34 -0400 (EDT)
Received: from 209-6-91-204.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com (HELO
	jerusalem.litteratus.org.litteratus.org) ([209.6.91.204])
	by smtp01.lnh.mail.rcn.net with ESMTP; 08 Apr 2010 08:10:35 -0400
From: Robert Huff <roberthuff@rcn.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <19389.51130.108457.400747@jerusalem.litteratus.org>
Date: Thu, 8 Apr 2010 08:10:34 -0400
To: Adam Vande More <amvandemore@gmail.com>
In-Reply-To: <o2s6201873e1004072155ie746928cx5faac5d3f8e1d8ef@mail.gmail.com>
References: <201004080252.o382qFH7019790@leka.aloha.com>
	<x2m6201873e1004072052u88a62b4eo7d1e9a457240937a@mail.gmail.com>
	<19389.23404.649946.265403@jerusalem.litteratus.org>
	<o2s6201873e1004072155ie746928cx5faac5d3f8e1d8ef@mail.gmail.com>
X-Mailer: VM 7.17 under 21.5  (beta28) "fuki" XEmacs Lucid
X-Junkmail-Whitelist: YES (by domain whitelist at mr08.lnh.mail.rcn.net)
Cc: Gary Dunn <osp@aloha.com>, Robert Huff <roberthuff@rcn.com>,
	freebsd-questions <freebsd-questions@freebsd.org>
Subject: Re: Kernel Config for NAT
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Apr 2010 12:10:35 -0000

Adam Vande More writes:

>  >        If compiled into the kernel, there's a set of optional settings
>  > (VERBOSE, LOG_LINIT, DEFAULT_TO_ACCEPT, etc) that can be set there.
>  >        If using the module, how does one set these?
>  >
>  Logging is compiled into the modules and there are a few sysctl's.  AFAIK,
>  everything else is the same.
>  
>  http://www.freebsd.org/doc/handbook/firewalls-ipfw.html

	So ... double-checking I'm doing this right:

1) in /boot/loader.conf:

ipfw_load="YES"
ipdivert_load="YES"

2) in the kernel config:

#options  IPFIREWALL              #firewall
#options  IPFIREWALL_VERBOSE      #enable logging to syslogd(8)
#options  IPFIREWALL_VERBOSE_LIMIT=100    #limit verbosity
#options  IPFIREWALL_DEFAULT_TO_ACCEPT    #allow everything by default
#options  IPDIVERT
#options  IPFIREWALL_NAT          #ipfw kernel nat support
options  LIBALIAS				# required for NAT

3) in /etc/sysctl.conf:

net.inet.ip.fw.default_to_accept="1"
net.inet.ip.fw.verbose="1"
net.inet.ip.fw.verbose_limit="100"


	That cover it?


			Robert Huff