NAT is already maintaining state – it is possible to combine stateful rules and NAT, but don't. ;-)
Are you really proposing to NAT twice, or is 192.168.1.2 a phony address for the purposes of discussion here? In any case, consider something like the following: #!/bin/sh fw="/sbin/ipfw -q" sysctl net.inet.ip.fw.one_pass=0 IP_JAIL="192.168.100.2" IP_EXIF="192.168.1.2" OIF="sk0" ################################################################################ # If 192.168.1.2 is really your interface address, you'll be nat'ing twice # on the way to the internet, which is ugly. You don't need the *unreg_only* # directive if you only have RFC1918 addresses anyway. You should clarify # if this is the case. *reset* kills all active nat sessions if you run this # script again. $fw flush $fw nat 1 config \ redirect_addr ${IP_EXIF} ${IP_JAIL} \ redirect_addr ${IP_JAIL} ${IP_EXIF} \ if ${OIF} unreg_only reset ################################################################################ # separate in and out as a matter of habit - don't mention protocol in nat # statement, do this in subsequent rules $fw add 01000 nat 1 ip from any to any in recv ${OIF} # check-state isn't needed, really, since it gets performed at the next # rule that mentions state #$#$#$#$# $fw add 01500 check-state # these will match traffic to/from external IP and not jail $fw add 02000 allow tcp from ${IP_EXIF} to any out setup keep-state $fw add 02010 allow udp from ${IP_EXIF} to any out keep-state $fw add 02020 allow icmp from ${IP_EXIF} to any out keep-state ################################################################################ # Why is this safe? because it will only match NAT return packets. # It only permits traffic to your jail in this case. Also, for TCP to # function properly, to need to accept ICMP error messages, esp. need-frag $fw add 02000 allow ip from any to ${IP_JAIL} ################################################################################ # outbound packets pass through nat $fw add 03000 nat 1 ip from any to any out xmit ${OIF} ################################################################################ # if your default rule (65535) is DENY, you need something like this. This will # match only NAT'd traffic $fw add 50000 allow ip from any to any out xmit ${OIF} On Sat, Jul 6, 2019 at 1:03 AM Yuri <y...@rawbw.com> wrote: > My network interface looks like this: > > sk0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 > options=80009<RXCSUM,VLAN_MTU,LINKSTATE> > ether 01:3c:47:8a:17:12 > inet 192.168.1.2 netmask 0xffffff00 broadcast 192.168.1.255 > inet 192.168.100.2 netmask 0xffffffff broadcast 192.168.100.2 > media: Ethernet autoselect (100baseTX <full-duplex>) > status: active > nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL> > > The second IP address is an alias that is used for jail. > > I would like to set up NAT so that this jail would access the internet > through the same interface. > > > I tried this script: > > > fw="/sbin/ipfw -q" > > $fw nat 1 config redirect_addr 192.168.100.2 192.168.1.2 redirect_addr > 192.168.1.2 192.168.100.2 if sk0 unreg_only reset > > $fw add 1001 nat 1 tcp from 192.168.100.2/32 to any via sk0 keep-state > > $fw add 1002 check-state > > > The rule 1001 has keep-state, therefore it should process both outgoing > tcp and incoming response packets. But the outbound packets are NATted, > but the inbound ones are not. > > What is wrong, and how to fix this script? > > > Thank you, > > Yuri > > > _______________________________________________ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" > -- "Well," Brahmā said, "even after ten thousand explanations, a fool is no wiser, but an intelligent person requires only two thousand five hundred." - The Mahābhārata _______________________________________________ freebsd-net@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"