From owner-freebsd-ipfw@freebsd.org Wed Mar 9 18:17:12 2016 Return-Path: Delivered-To: freebsd-ipfw@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 28233AC9F59 for ; Wed, 9 Mar 2016 18:17:12 +0000 (UTC) (envelope-from fjwcash@gmail.com) Received: from mail-ig0-x229.google.com (mail-ig0-x229.google.com [IPv6:2607:f8b0:4001:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id E7952BA1; Wed, 9 Mar 2016 18:17:11 +0000 (UTC) (envelope-from fjwcash@gmail.com) Received: by mail-ig0-x229.google.com with SMTP id vs8so79067396igb.1; Wed, 09 Mar 2016 10:17:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=xVk1+ifP+zy1pa06gfO3wn+noW8qb5XkjB1BlVezO4w=; b=Eix7qywyGyCjOtd8nSFnoUk74Z/k50zciNb5f8RNK344/S0O2ulWm+NJqpwqyVajSF xJVERSDeFFNKq3lTQDpKEURFYsOEaY6qYgQGi8KL0xpVpEUHCtQ6EFU9Fh8Dx6C2hKkF x5fBXesdAjzakF7/jWUYlu0S8aBxf+rsYtL/XM9ImnEFzpvm5wPrYz8MrPvKvHCKVfX7 vAe5nZ0iERflT6jgWOI6nS9ZM0ZjYY3KqNLoqfOWEbdU7Y6nWimPrA21HD0wEmq360tg pq8EPoQ2cHvb6KOjFfdsB27dKaWiar+f6DG/eYU56JWtitFB1slBbzdshypsoh1IDBpk NV8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=xVk1+ifP+zy1pa06gfO3wn+noW8qb5XkjB1BlVezO4w=; b=bhshtsYhxPIIbaPPBRWOpAtEJTfAXlPzkSdOXkGd6irTFUzBx+41m8VvXfJlDNtwrJ xEI5qv49RtR7sZx7FP5c6QyG+YIigZgSuhys1CbGJa5xb7JRtLavGCDvr0lt6fpr40I4 4iIxyUAAtpch8YKER/Z4iI011xSgCnPlVDXKMPW27mnyD/4D7p63HE3VBMqOn/CIQ2/Q /n7yk+d7OMgJSpWaSN1Vp2IGoLL+bB6w75rgosoiZYYJLOi6G8fZ8BXKWnoANjkZGfdZ 3g6xAlxHMThDrtaXVc0fuT0maX5/sJMyY8n0ugScQgM7JDkgLhxdy5IR3g3Ah8mxm0MG 7VGg== X-Gm-Message-State: AD7BkJLCNFGLXUkR4OLjTcOO85BFC0AVk8YFIr6O+GmGn97yk7gCoyBY0IlQsQ5JGvyxnxsVMGfg6zh6I0m42g== MIME-Version: 1.0 X-Received: by 10.50.65.1 with SMTP id t1mr27047978igs.34.1457547431312; Wed, 09 Mar 2016 10:17:11 -0800 (PST) Received: by 10.107.140.129 with HTTP; Wed, 9 Mar 2016 10:17:11 -0800 (PST) In-Reply-To: <201603091809.u29I9PEv011156@gw.catspoiler.org> References: <201603091809.u29I9PEv011156@gw.catspoiler.org> Date: Wed, 9 Mar 2016 10:17:11 -0800 Message-ID: Subject: Re: ipwf dummynet vs. kernel NAT and firewall rules From: Freddie Cash To: Don Lewis Cc: "freebsd-ipfw@freebsd.org" Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.21 X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 18:17:12 -0000 On Wed, Mar 9, 2016 at 10:09 AM, Don Lewis wrote: > On 9 Mar, Franco Fichtner wrote: > > Hi Don, > > > > If you mean pf(4)-based NAT, there is a patch that originates from > > m0n0wall that handles the transition. We're using it in OPNsense > > for that reason. Here is the patch for 10.x, maybe that is what > > you're looking for: > > Nope, I'm using ipfw in-kernel NAT, which is not the default in > rc.firewall, but is easy to paste in next to or in place of the default > natd configuration. > > case ${firewall_nat_enable} in > [Yy][Ee][Ss]) > if [ -n "${firewall_nat_interface}" ]; then > if echo "${firewall_nat_interface}" | \ > grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; the= n > firewall_nat_flags=3D"ip > ${firewall_nat_interface} ${firewall_nat_flags}" > else > firewall_nat_flags=3D"if > ${firewall_nat_interface} ${firewall_nat_flags}" > fi > ${fwcmd} nat 123 config log ${firewall_nat_flags} > ${fwcmd} add nat 123 ip4 from any to any via > ${firewall_nat_interface} > fi > ;; > esac > > My suspicion is that if a packet matches the rule to pass it to dummynet > that it is bypassing NAT. > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" > =E2=80=8BDo you have the sysctl net.inet.ip.fw.one_pass set to 0 or 1? If set to 1, the a dummynet match ends the trip through the rules, and the packet never gets to the NAT rules. Or, if a NAT rule matches, the trip through the rules ends, and it never get to the dummynet rules. Depending on which you have first. You'll need to set net.inet.ip.fw.one_pass=E2=80=8B=3D0 in order to re-inje= ct the packet into the rules after it matches a dummynet or NAT rule. Or, do the NAT and dummynet rules on different interfaces to match different traffic. --=20 Freddie Cash fjwcash@gmail.com