From owner-freebsd-questions@FreeBSD.ORG  Fri Apr  9 12:35:06 2010
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 7E8E8106564A
	for <freebsd-questions@freebsd.org>;
	Fri,  9 Apr 2010 12:35:06 +0000 (UTC)
	(envelope-from roberthuff@rcn.com)
Received: from smtp02.lnh.mail.rcn.net (smtp02.lnh.mail.rcn.net
	[207.172.157.102])
	by mx1.freebsd.org (Postfix) with ESMTP id 3FACE8FC24
	for <freebsd-questions@freebsd.org>;
	Fri,  9 Apr 2010 12:35:05 +0000 (UTC)
Received: from mr02.lnh.mail.rcn.net ([207.172.157.22])
	by smtp02.lnh.mail.rcn.net with ESMTP; 09 Apr 2010 08:35:05 -0400
Received: from smtp01.lnh.mail.rcn.net (smtp01.lnh.mail.rcn.net [207.172.4.11])
	by mr02.lnh.mail.rcn.net (MOS 3.10.8-GA) with ESMTP id QPY84556;
	Fri, 9 Apr 2010 08:34:46 -0400 (EDT)
Received: from 209-6-91-204.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com (HELO
	jerusalem.litteratus.org.litteratus.org) ([209.6.91.204])
	by smtp01.lnh.mail.rcn.net with ESMTP; 09 Apr 2010 08:34:46 -0400
From: Robert Huff <roberthuff@rcn.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <19391.7909.888110.689450@jerusalem.litteratus.org>
Date: Fri, 9 Apr 2010 08:34:45 -0400
To: Ian Smith <smithi@nimnet.asn.au>
In-Reply-To: <20100409160704.K52200@sola.nimnet.asn.au>
References: <20100408234803.7519B1065770@hub.freebsd.org>
	<20100409160704.K52200@sola.nimnet.asn.au>
X-Mailer: VM 7.17 under 21.5  (beta28) "fuki" XEmacs Lucid
X-Junkmail-Whitelist: YES (by domain whitelist at mr02.lnh.mail.rcn.net)
Cc: Adam Vande More <amvandemore@gmail.com>, Robert Huff <roberthuff@rcn.com>,
	freebsd-questions@freebsd.org
Subject: Re: Kernel Config for NAT
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 09 Apr 2010 12:35:06 -0000


Ian Smith writes:

>   > 	So ... double-checking I'm doing this right:
>   > 
>   > 1) in /boot/loader.conf:
>   > 
>   > ipfw_load="YES"
>   > ipdivert_load="YES"
>  
>  I thought from your earlier mail that you wanted to use in-kernel
>  NAT?

	I want whatever works.  :-)
	Beyond that ... all other things being more-or-less equal I'll
do this with modules.
	Let's build that.  So in /etc/sysctl.conf:

net.inet.ip.fw.default_to_accept="1"
net.inet.ip.fw.verbose="1"
net.inet.ip.fw.verbose_limit="100"

	check.

>  I believe all these can be accomplished with modules on GENERIC
>  kernel, at least on 8.x, with the exception of FIREWALL_FORWARD
>  functionality which does require a custom kernel as it messes
>  with lots of ip paths.

	This machine has a custom kernel, so that's not a an issue.
	And in /boot/loader.conf:

ipfw_load="YES"
ipfw_nat="YES"	# in-kernel ipfw nat
libalias="YES"	# for in-kernel ipfw nat

	check.
	and in the kernel config:

#options  IPFIREWALL              #firewall
#options  IPFIREWALL_VERBOSE      #enable logging to syslogd(8)

options  IPFIREWALL_FORWARD

#options  IPFIREWALL_VERBOSE_LIMIT=100    #limit verbosity
#options  IPFIREWALL_DEFAULT_TO_ACCEPT    #allow everything by default
#options  IPDIVERT
#options  IPFIREWALL_NAT          #ipfw kernel nat support
#options  LIBALIAS				# required for NAT

	check.
	This combination will get me a) ipfw, using the standard
rc.conf "firewall_" variables, and b) NAT ... do I still need to
have a "nat" setting in the firewall rules?

	Less confused than last time,


				Robert Huff