Date: Mon, 19 Jan 2004 20:28:17 -0800 (PST) From: Ken Bolingbroke <hacker@bolingbroke.com> To: fbsd_user <fbsd_user@a1poweruser.com> Cc: freebsd-questions@freebsd.org Subject: RE: ipfw/nated stateful rules example Message-ID: <20040119201738.B30318@fremont.bolingbroke.com> In-Reply-To: <MIEPLLIBMLEEABPDBIEGAEDEFFAA.fbsd_user@a1poweruser.com> References: <MIEPLLIBMLEEABPDBIEGAEDEFFAA.fbsd_user@a1poweruser.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 19 Jan 2004, fbsd_user wrote: > That's a play on words. And still does not prove stateful rules work on > the interface facing the public internet. There is no documentation that > says keep-state and limit only works on the interface facing the private > Lan network. And the implied meaning is they are to be used on the > interface facing the public internet. I just jumped in the middle here, so I may be out of context. But, stateful rules don't play nice with NAT. Consider non-NAT, a public IP address contacting an Internet address: 67.161.59.61 -> 66.218.71.91 A rule is created for 66.218.71.91 coming to 67.161.59.61. When 66.218.71.91 replies, the stateful rule lets it in. This is good. But consider NAT: 10.0.0.10 changed to 67.161.59.61 -> 66.218.71.91 If you do a keep-state before NAT, you have a rule to allow 66.218.71.91 to 10.0.0.10, but the return incoming packet will be 66.218.71.91 -> 67.161.59.61, so the rule doesn't match. If you do a keep-state after NAT, then you have a rule to allow 66.218.71.91 to 67.161.59.61. The return incoming packet matches that rule, but it accepts the packet and packet processing stops, so it's never passed through NAT, and never makes it back to 10.0.0.10. So as it stands now, I don't see that you can use stateful connections with NAT, unless check-state is changed to allow a packet to be passed through NAT. Ken Bolingbroke hacker@bolingbroke.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040119201738.B30318>