On 06.07.2019 11:01, Yuri wrote: > My network interface looks like this: > $fw nat 1 config redirect_addr 192.168.100.2 192.168.1.2 redirect_addr > 192.168.1.2 192.168.100.2 if sk0 unreg_only reset > > $fw add 1001 nat 1 tcp from 192.168.100.2/32 to any via sk0 keep-state > > $fw add 1002 check-state > > > The rule 1001 has keep-state, therefore it should process both outgoing > tcp and incoming response packets. But the outbound packets are NATted, > but the inbound ones are not. > > What is wrong, and how to fix this script?
'keep-state' creates state for TCP connection that is not yet translated, thus it won't handle the reply packet, that has translated address/port. -- WBR, Andrey V. Elsukov
signature.asc
Description: OpenPGP digital signature
