Date: Wed, 9 Mar 2016 10:09:25 -0800 (PST) From: Don Lewis <truckman@FreeBSD.org> To: franco@lastsummer.de Cc: freebsd-ipfw@freebsd.org Subject: Re: ipwf dummynet vs. kernel NAT and firewall rules Message-ID: <201603091809.u29I9PEv011156@gw.catspoiler.org> In-Reply-To: <DA540940-CED7-4E2E-8E1D-5088A140F2CB@lastsummer.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On 9 Mar, Franco Fichtner wrote: > Hi Don, > > If you mean pf(4)-based NAT, there is a patch that originates from > m0n0wall that handles the transition. We're using it in OPNsense > for that reason. Here is the patch for 10.x, maybe that is what > you're looking for: Nope, I'm using ipfw in-kernel NAT, which is not the default in rc.firewall, but is easy to paste in next to or in place of the default natd configuration. case ${firewall_nat_enable} in [Yy][Ee][Ss]) if [ -n "${firewall_nat_interface}" ]; then if echo "${firewall_nat_interface}" | \ grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; then firewall_nat_flags="ip ${firewall_nat_interface} ${firewall_nat_flags}" else firewall_nat_flags="if ${firewall_nat_interface} ${firewall_nat_flags}" fi ${fwcmd} nat 123 config log ${firewall_nat_flags} ${fwcmd} add nat 123 ip4 from any to any via ${firewall_nat_interface} fi ;; esac My suspicion is that if a packet matches the rule to pass it to dummynet that it is bypassing NAT.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201603091809.u29I9PEv011156>