Date: Wed, 10 Mar 2004 11:53:40 +1100 From: ktulu@net2000.com.au To: freebsd-net@freebsd.org Subject: natd interface alias question Message-ID: <1078880020.404e6714a1235@secure.net2000.com.au>
next in thread | raw e-mail | index | archive | help
Hi All, I've been playing around with this for a few weeks now and searched Google endlessly, but still can't find a solution... I apologise in advance for the length of this post. Basically, I have a freebsd machine that acts as a proxy and web server to a web application we are currently developing. The machine is configured to serve up web pages via Apache on port 80, but forward any traffic requested on port 443 to another machine behind the firewall. Below are the relevant parts of the rc.conf file: network interfaces="fxp1 lo0" ifconfig_lo0="inet 127.0.0.1" ifconfig_fxp1="inet 192.168.1.10 netmask 255.255.0.0" gateway_enable="YES" natd_enable="YES" natd_interface="fxp1" natd_flags="-l -m -redirect_port tcp 192.168.1.20:443 443" I have set the firewall to "allow ip any to any" for the sake of simplifying the problem. The configuration above works fine for one IP - when I request https://192.168.1.10/ it serves the page from 192.168.1.20. I have written a script to add another IP to the machine to perform the same task, which is where the problems begin. Basically the script issues the following commands: # Add the alias to fxp1 ifconfig fxp1 inet 192.168.1.11 netmask 255.255.255.255 alias (still not sure why the subnet mask here has to be 0xffffffff, even if I specify fxp0, which is a physically different port, but anyway it works) # Create a natd instance for the newly configured IP: /sbin/natd -n fxp1 -port 8669 -m -redirect_port tcp 192.168.1.21:443 192.168.1.11 443 # Restart the networking /etc/netstart As far as Apache is concerned this configuration is fine and it serves the correct page as configured in the VirtualHosts (on port 80). The problem is, is that if I request https://192.168.1.11/, the browser times out and does not serve the page from 192.168.1.21. Why is it that it works for one and not the aliased IP? natd does not bind to port 443 (at least nmap doesn't report it), so it's not that port 443 is already bound. If natd/FreeBSD actually capable of such a configuration or am I just overlooking something fundamental?!? Any help would be much appreciated! Thanks, Leigh P.S - I'm running FreeBSD 4.8-RELEASE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1078880020.404e6714a1235>