Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 9 Mar 2016 10:17:11 -0800
From:      Freddie Cash <fjwcash@gmail.com>
To:        Don Lewis <truckman@freebsd.org>
Cc:        "freebsd-ipfw@freebsd.org" <freebsd-ipfw@freebsd.org>
Subject:   Re: ipwf dummynet vs. kernel NAT and firewall rules
Message-ID:  <CAOjFWZ5=ffj-mHWDvmsc=JDVSKc8Ttck-Ukg-RqUpuOcUsTdOw@mail.gmail.com>
In-Reply-To: <201603091809.u29I9PEv011156@gw.catspoiler.org>
References:  <DA540940-CED7-4E2E-8E1D-5088A140F2CB@lastsummer.de> <201603091809.u29I9PEv011156@gw.catspoiler.org>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On Wed, Mar 9, 2016 at 10:09 AM, Don Lewis <truckman@freebsd.org> wrote:

> On  9 Mar, Franco Fichtner wrote:
> > Hi Don,
> >
> > If you mean pf(4)-based NAT, there is a patch that originates from
> > m0n0wall that handles the transition.  We're using it in OPNsense
> > for that reason.  Here is the patch for 10.x, maybe that is what
> > you're looking for:
>
> Nope, I'm using ipfw in-kernel NAT, which is not the default in
> rc.firewall, but is easy to paste in next to or in place of the default
> natd configuration.
>
>         case ${firewall_nat_enable} in
>         [Yy][Ee][Ss])
>                 if [ -n "${firewall_nat_interface}" ]; then
>                         if echo "${firewall_nat_interface}" | \
>                                 grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; the=
n
>                                 firewall_nat_flags=3D"ip
> ${firewall_nat_interface} ${firewall_nat_flags}"
>                         else
>                                 firewall_nat_flags=3D"if
> ${firewall_nat_interface} ${firewall_nat_flags}"
>                         fi
>                         ${fwcmd} nat 123 config log ${firewall_nat_flags}
>                         ${fwcmd} add nat 123 ip4 from any to any via
> ${firewall_nat_interface}
>                 fi
>                 ;;
>         esac
>
> My suspicion is that if a packet matches the rule to pass it to dummynet
> that it is bypassing NAT.
> _______________________________________________
> freebsd-ipfw@freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"
>

=E2=80=8BDo you have the sysctl net.inet.ip.fw.one_pass set to 0 or 1?

If set to 1, the a dummynet match ends the trip through the rules, and the
packet never gets to the NAT rules.  Or, if a NAT rule matches, the trip
through the rules ends, and it never get to the dummynet rules.  Depending
on which you have first.

You'll need to set net.inet.ip.fw.one_pass=E2=80=8B=3D0 in order to re-inje=
ct the
packet into the rules after it matches a dummynet or NAT rule.  Or, do the
NAT and dummynet rules on different interfaces to match different traffic.

--=20
Freddie Cash
fjwcash@gmail.com



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?CAOjFWZ5=ffj-mHWDvmsc=JDVSKc8Ttck-Ukg-RqUpuOcUsTdOw>