Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 21 Jun 2001 14:05:53 -0500 (CDT)
From:      Nick Rogness <nick@rogness.net>
To:        Chuck Rock <carock@epctech.com>
Cc:        freebsd-ipfw@FreeBSD.ORG
Subject:   Re: Natd and IPFW ( I think I've asked before with no help)...
Message-ID:  <Pine.BSF.4.21.0106211344080.13834-100000@cody.jharris.com>
In-Reply-To: <001801c0fa68$7c955c80$1805010a@epconline.net>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On Thu, 21 Jun 2001, Chuck Rock wrote:

> We are deploying FreeBSD firewalls with NATD running as well.
> 
> Problem 1.
> We have aliased real IP's on an interface, but natd.cf only lets us
> forward ports from the original interface IP, not from the aliased
> IP's. So we have to like four network cards and multiple firewalls to
> accomplish the desired routing of ports by real IP address to internal
> private IP's.
> 
> Has anyone fixed this, or come up with a better solution?

	I'm not clear on what you are saying here.
	alias_address option of nat will let you specify your outside
	address...it doesn't have to be bound to any interface.

	redirect_address works like Static NAT if that is what you want.

	Please Clarify what you mean...from the outside to the inside OR
	from the inside to the outside?

> 
> Problem 2.
> We also use Portsentry, and when we forward ports with natd, they
> forward BEFORE portsentry can see them. So if we have an internal
> machine as a mail server, and forward a real IP to an internal IP for
> port 25, but we use portsentry to watch traffic on that real IP, it
> never sees portscans on IP because natd never passes the packets that
> don't match the forwarding to the level that Portsentry is watching.

	Hmmm, not sure what to do here.  I'm not sure how PortSentry
	works. If it uses BPF to watch traffic it should work, so it must
	not use that...

	Is Port sentry listening on the outside interface?

> 
> Would running natd from rc.local aleviate this? Is that possible?
> 
	That has nothing to do with it.  That just deals with loading
	progams when booting the system.  ANd yes, you can start natd from
	rc.local.


Nick Rogness <nick@rogness.net>
 - Keep on Routing in a Free World...
  "FreeBSD: The Power to Serve!"



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message




Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0106211344080.13834-100000>