NAT is already maintaining state – it is possible to combine stateful rules
and NAT, but don't. ;-)
Are you really proposing to NAT twice, or is 192.168.1.2 a phony address
for the purposes of discussion here?
In any case, consider something like the following:
#!/bin/sh
fw="/sbin/ipfw -q"
sysctl net.inet.ip.fw.one_pass=0
IP_JAIL="192.168.100.2"
IP_EXIF="192.168.1.2"
OIF="sk0"
################################################################################
# If 192.168.1.2 is really your interface address, you'll be nat'ing twice
# on the way to the internet, which is ugly. You don't need the *unreg_only*
# directive if you only have RFC1918 addresses anyway. You should clarify
# if this is the case. *reset* kills all active nat sessions if you run this
# script again.
$fw flush
$fw nat 1 config \
redirect_addr ${IP_EXIF} ${IP_JAIL} \
redirect_addr ${IP_JAIL} ${IP_EXIF} \
if ${OIF} unreg_only reset
################################################################################
# separate in and out as a matter of habit - don't mention protocol in nat
# statement, do this in subsequent rules
$fw add 01000 nat 1 ip from any to any in recv ${OIF}
# check-state isn't needed, really, since it gets performed at the next
# rule that mentions state
#$#$#$#$# $fw add 01500 check-state
# these will match traffic to/from external IP and not jail
$fw add 02000 allow tcp from ${IP_EXIF} to any out setup keep-state
$fw add 02010 allow udp from ${IP_EXIF} to any out keep-state
$fw add 02020 allow icmp from ${IP_EXIF} to any out keep-state
################################################################################
# Why is this safe? because it will only match NAT return packets.
# It only permits traffic to your jail in this case. Also, for TCP to
# function properly, to need to accept ICMP error messages, esp. need-frag
$fw add 02000 allow ip from any to ${IP_JAIL}
################################################################################
# outbound packets pass through nat
$fw add 03000 nat 1 ip from any to any out xmit ${OIF}
################################################################################
# if your default rule (65535) is DENY, you need something like this. This
will
# match only NAT'd traffic
$fw add 50000 allow ip from any to any out xmit ${OIF}
On Sat, Jul 6, 2019 at 1:03 AM Yuri <y...@rawbw.com> wrote:
> My network interface looks like this:
>
> sk0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
> options=80009<RXCSUM,VLAN_MTU,LINKSTATE>
> ether 01:3c:47:8a:17:12
> inet 192.168.1.2 netmask 0xffffff00 broadcast 192.168.1.255
> inet 192.168.100.2 netmask 0xffffffff broadcast 192.168.100.2
> media: Ethernet autoselect (100baseTX <full-duplex>)
> status: active
> nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
>
> The second IP address is an alias that is used for jail.
>
> I would like to set up NAT so that this jail would access the internet
> through the same interface.
>
>
> I tried this script:
>
>
> fw="/sbin/ipfw -q"
>
> $fw nat 1 config redirect_addr 192.168.100.2 192.168.1.2 redirect_addr
> 192.168.1.2 192.168.100.2 if sk0 unreg_only reset
>
> $fw add 1001 nat 1 tcp from 192.168.100.2/32 to any via sk0 keep-state
>
> $fw add 1002 check-state
>
>
> The rule 1001 has keep-state, therefore it should process both outgoing
> tcp and incoming response packets. But the outbound packets are NATted,
> but the inbound ones are not.
>
> What is wrong, and how to fix this script?
>
>
> Thank you,
>
> Yuri
>
>
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
>
--
"Well," Brahmā said, "even after ten thousand explanations, a fool is no
wiser, but an intelligent person requires only two thousand five hundred."
- The Mahābhārata
_______________________________________________
freebsd-net@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
