From owner-freebsd-ipfw@FreeBSD.ORG Wed Jun 2 15:34:02 2004 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7FFEC16A4CE for ; Wed, 2 Jun 2004 15:34:02 -0700 (PDT) Received: from mail3.speakeasy.net (mail3.speakeasy.net [216.254.0.203]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3E73443D49 for ; Wed, 2 Jun 2004 15:34:02 -0700 (PDT) (envelope-from freebsd-ipfw.20.openmacews@spamgourmet.com) Received: (qmail 32357 invoked from network); 2 Jun 2004 22:34:01 -0000 Received: from ns1.presence-group.net (HELO [172.30.11.6]) (blakers@[216.27.177.134]) )encrypted SMTP for ; 2 Jun 2004 22:34:01 -0000 Date: Wed, 02 Jun 2004 15:33:58 -0700 From: OpenMacNews To: freebsd-ipfw Message-ID: X-Mailer: Mulberry/3.1.5 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Subject: does NATd _prevent_ use of stateful ipfw rules w/ keep-state? X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: OpenMacNews List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Jun 2004 22:34:02 -0000 In continued digging for some guidance w.r.t. my earlier post, I came across the following list comment ... > The real show stopper is ipfw with stateful rules using the 'keep state' > option does not work when used with the divert/nated legacy sub-routine. > What this means is ipfw with stateful rules can only be used if > 'user ppp -nat' is how you connect to the public internet. Is this in fact true? If using NATd, am I relegated to a _static_ ruleset, w/ no ability to use stateful rules? Richard