Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 9 Mar 2016 10:09:25 -0800 (PST)
From:      Don Lewis <truckman@FreeBSD.org>
To:        franco@lastsummer.de
Cc:        freebsd-ipfw@freebsd.org
Subject:   Re: ipwf dummynet vs. kernel NAT and firewall rules
Message-ID:  <201603091809.u29I9PEv011156@gw.catspoiler.org>
In-Reply-To: <DA540940-CED7-4E2E-8E1D-5088A140F2CB@lastsummer.de>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On  9 Mar, Franco Fichtner wrote:
> Hi Don,
> 
> If you mean pf(4)-based NAT, there is a patch that originates from
> m0n0wall that handles the transition.  We're using it in OPNsense
> for that reason.  Here is the patch for 10.x, maybe that is what
> you're looking for:

Nope, I'm using ipfw in-kernel NAT, which is not the default in
rc.firewall, but is easy to paste in next to or in place of the default
natd configuration.

        case ${firewall_nat_enable} in
        [Yy][Ee][Ss])
                if [ -n "${firewall_nat_interface}" ]; then
                        if echo "${firewall_nat_interface}" | \
                                grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; then
                                firewall_nat_flags="ip ${firewall_nat_interface} ${firewall_nat_flags}"
                        else
                                firewall_nat_flags="if ${firewall_nat_interface} ${firewall_nat_flags}"
                        fi
                        ${fwcmd} nat 123 config log ${firewall_nat_flags}
                        ${fwcmd} add nat 123 ip4 from any to any via ${firewall_nat_interface}
                fi
                ;;
        esac

My suspicion is that if a packet matches the rule to pass it to dummynet
that it is bypassing NAT.



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?201603091809.u29I9PEv011156>