Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 8 Jun 2004 22:59:22 -0400
From:      "JJB" <>
To:        <>, <>
Cc:        "freebsd-questions@FreeBSD. ORG" <freebsd-questions@FreeBSD.ORG>
Subject:   RE: does NATd _prevent_ use of stateful ipfw rules w/ keep-state?
Message-ID:  <>
In-Reply-To: <>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
Thanks for your example. I have finally had time to study it
and I see the flaw in it.

The example works fine for creating the entry in the dynamic table
for setup of keep-state inbound and outbound session start requests.
It even handles inbound packets that are part of an established
conversations, But for established outbound session conversations
the check-state rule releases the packet before it has been nated.

There lies in the flaw.

Do you have any suggestions on how to correct this?

-----Original Message-----
[]On Behalf Of Thomas Wolf
Sent: Thursday, June 03, 2004 3:00 AM
Subject: RE: does NATd _prevent_ use of stateful ipfw rules w/

JJB <> schrieb:

> Where do you get off calling my questioning of Luigi Rizzo's
> as an attack.
> I have heard that party line statement all to often over that last
> years, with no backup proof. That party line canned answer may be
> sufficient for the original thread poster who has not invested the
> time yet to come to the realization that it doe's not work.
> My post to the tread was meant to bring this problem out so the
> experts can look into it and take corrective actions.

This should work although some features are missing
(loopback, anti-spoofing, identd..):

cmd="ipfw add"
allow="skipto 10000"
good_icmp="icmptypes 0,3,8,11,12"
ipfw -f flush

$cmd 100 divert natd ip from any to any in via $oif
$cmd 105 check-state
$cmd 110 $allow icmp from any to any $good_icmp
$cmd 120 $allow udp from any to any $good_udp out keep-state
$cmd 130 $allow tcp from any to any $good_tcp out setup keep-state
$cmd 140 deny $log ip from any to any
$cmd 10000 divert natd ip from any to any out via $oif
$cmd 10010 allow ip from any to any
$cmd 10020 deny ip from any to any


Thomas Wolf
Wiener Software Fabrik
Dubas u. Wolf GMBH
1050 Wien, Mittersteig 4

_______________________________________________ mailing list
To unsubscribe, send any mail to

Want to link to this message? Use this URL: <>