Date: Wed, 5 Jan 2005 12:23:51 +0900 From: Pyun YongHyeon <yongari@kt-is.co.kr> To: Hideki Yamamoto <yamamoto436@oki.com> Cc: freebsd-pf@freebsd.org Subject: Re: pf NAT function with IPv6 Message-ID: <20050105032351.GA8022@kt-is.co.kr> In-Reply-To: <20041230.232305.71087886.yamamoto436@oki.com> References: <20041230.232305.71087886.yamamoto436@oki.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Dec 30, 2004 at 11:23:05PM +0900, Hideki Yamamoto wrote: > > Hi, > > I tried to use pf to change source address of IPv6 UDP packet, but it does not go well. > As the output of 'pfctl' command seems no problem. > I wonder if pf on FreeBSD does not support IPv6 now. > AFAIK, No. pf is the only firewall that supports (almost) full IPv6 in BSDs. > > ---------- /etc/pf.conf ------------- start > ext_if="bge2" > int_if="bge0" > internal_net="fec0:0:0:d::0/32" > nat on bge2 inet6 from fec0:0:0:d::1 to any -> 2001:b90:ee00:ff0b::1:3 > ---------- /etc/pf.conf ------------- end > > tsrmldgw3# pfctl -s state > No ALTQ support in kernel > ALTQ related functions disabled > self udp fec0:0:0:d::1[15001] -> 2001:b90:ee00:ff0b::1:3[52925] -> 2001:b90:ee00:51b:208:4ff:fe28:a1d2[8001] > SINGLE:NO_TRAFFIC > Works here. Tested on FreeBSD-CURRENT sparc64 mars# pfctl -ss self tcp fec0:0:0:d::1[49152] -> 2001:b90:ee00:ff0b::1[51223] -> 2001:b90:ee00:ff0b::10[22] ESTABLISHED:ESTABLISHED self tcp fec0:0:0:d::1[22] <- 2001:b90:ee00:ff0b::1[22] <- 2001:b90:ee00:ff0b::10[49154] ESTABLISHED:ESTABLISHED mars# pfctl -sr pass in on hme0 inet6 proto tcp all flags S/SA keep state pass out on hme0 inet6 proto tcp all flags S/SA keep state mars# pfctl -sn nat on hme0 inet6 proto tcp from ! (hme0) to any -> 2001:b90:ee00:ff0b::1 rdr on hme0 inet6 proto tcp from any to any port = ssh -> fec0:0:0:d::1 port 22 Due to lack of hardware and IPv6 setup I tested ssh connection. But there is no reason UDP don't work. -- Regards, Pyun YongHyeon http://www.kr.freebsd.org/~yongari | yongari@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050105032351.GA8022>