Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 7 Jun 2016 00:53:23 +0300
From:      "Andrey V. Elsukov" <>
Cc:        "Alexander V. Chernikov" <>, Julian Elischer <>
Subject:   Re: IPFW: more "orthogonal? state operations, push into 11?
Message-ID:  <>
In-Reply-To: <>
References:  <>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
Content-Type: multipart/mixed; boundary="5DtqKvFN43bWq2CDFVnRFbIeOfPAaNTj0"
From: "Andrey V. Elsukov" <>
Cc: "Alexander V. Chernikov" <>,
 Julian Elischer <>
Message-ID: <>
Subject: Re: IPFW: more "orthogonal? state operations, push into 11?
References: <>
In-Reply-To: <>

Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 06.06.16 22:41, Lev Serebryakov wrote:
>  I still hope to see committed before=

>  It seems to me, that I does everything what was requested by reviewers=

Hi Lev,

looking at provided description and examples, seems the main task you
want to solve is problem with NAT. But from my point of view, you are
trying to solve it in a easy way wrongly using existing methods.

As you described in patch to ipfw(8) "Problem is, you need to create
dynamic rule before NAT and check it after NAT actions (or vice versa)
to have consistent addresses and ports."

In terms of ipfw(4) a state is represented by ipfw_flow_id structure.
To solve your task you just needs two states - one for not translated
flow and second - for translated. Due to limits of implementation this
looks impossible to solve. But proposed patch with deferred action looks
too hackish to me.

With the following patch you will be able create two different states, I
think, and solve your task with NAT and dynamic rules:

WBR, Andrey V. Elsukov


Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

Version: GnuPG v2
Comment: Using GnuPG with Thunderbird -



Want to link to this message? Use this URL: <>