Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 3 Aug 2002 16:14:57 -0400
From:      "Joe & Fhe Barbish" <>
To:        "Michael Sierchio" <>
Cc:        "Crist J. Clark" <cjc@FreeBSD.ORG>, "FBIPFW" <>, <>, <>, <>, <>, <>, <>, <>, <>
Subject:   RE: natd & keep-state
Message-ID:  <>
In-Reply-To: <>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help

You give an example based on having two ip addresses on my
outside interface. The outside address is that single ip address
assigned by my ISP. Your keep-state rules are generic allowing no
selection by port number or the direction the packet is traveling,
IE. entering my private network from the public internet or leaving my
private network for the public internet.
I need selection control allowing only certain types of packets.

Please clarify what you are talking about and make your changes to my
posted rules file so we stay on the same page when discussing solutions.


-----Original Message-----
From: owner-freebsd-ipfw@FreeBSD.ORG
[mailto:owner-freebsd-ipfw@FreeBSD.ORG]On Behalf Of Michael Sierchio
Sent: Saturday, August 03, 2002 3:21 PM
Cc: Crist J. Clark; FBIPFW;;;;;;;;
Subject: Re: natd & keep-state

Joe & Fhe Barbish wrote:
> So Crist we meet again.

[scads of drivel deleted]

As Crist stated, ipfw stateful rules and natd aren't inherently
compatible, but it is possible to use them together.  This is
facilitated by using at least two IP addresses on the outside
interface, and some non-intuitive rules.

A brief snippet:


fw="/sbin/ipfw -q"

# some rules skipped for this example

#note the asymmetry

$fw add 02000 divert natd ip from any to $ipaddr2 in recv $oif
$fw add 02000 divert natd ip from any to any out xmit $oif

$fw add 02400 check-state

$fw add 02500 allow icmp from any to any icmptype 0,3,8,11

# natd is invoked with 'deny_incoming'

$fw add 02620 allow ip from $ipaddr2 to any
$fw add 02630 allow ip from any to $ipaddr2

$fw add 05800 allow udp from $ipaddr1 to any keep-state
$fw add 05900 allow tcp from $ipaddr1 to any setup keep-state

$fw add 65000 deny ip from any to any

To Unsubscribe: send mail to
with "unsubscribe freebsd-ipfw" in the body of the message

To Unsubscribe: send mail to
with "unsubscribe freebsd-ipfw" in the body of the message

Want to link to this message? Use this URL: <>