It very well could be the booze 2 nights ago making me misread
something obvious, but should not
nat on $ext_if from {$internal204,!$server1,!$server2} to any ->
$officepublicIP
be the same as
nat on $ext_if from
{10.0.0.1,10.0.0.4,10.0.0.5,10.0.0.6,10.0.0.7,10.0.0.8/29,10.0.0.16/28,10.0.0.32/27}
to any -> $officepublicIP
and the same as
nat on $ext_if from <204network> to any -> $officepublicIP
Where
officepublicIP=67.43.133.205
internal204=10.0.0.0/26
server1=10.0.0.2/32
server2=10.0.0.3/32
table <204network> {!$server1,!$server2,$internal204}
If I use the first nat statement, traffic from my DMZ (199.212.134.7)
gets natted as $officepublicIP. If I use the second (explicit list)
or third (define the list in a table) all works as expected and
199.212.134.7 does not get caught up in the nat statement.
# pfctl -sn
nat on tun0 inet from 192.168.10.0/24 to any -> (tun0:0)
nat on tun0 inet from 10.0.0.0/26 to any -> 67.43.133.205
nat on tun0 inet from ! 10.0.0.2 to any -> 67.43.133.205
nat on tun0 inet from ! 10.0.0.3 to any -> 67.43.133.205
nat on tun0 inet from 192.168.1.0/24 to any -> 67.43.133.204
binat on tun0 inet from 10.0.0.2 to any -> 67.43.133.206
binat on tun0 inet from 10.0.0.3 to any -> 67.43.133.207
vs
# pfctl -sn
nat on tun0 inet from 192.168.10.0/24 to any -> (tun0:0)
nat on tun0 inet from 10.0.0.1 to any -> 67.43.133.205
nat on tun0 inet from 10.0.0.4 to any -> 67.43.133.205
nat on tun0 inet from 10.0.0.5 to any -> 67.43.133.205
nat on tun0 inet from 10.0.0.6 to any -> 67.43.133.205
nat on tun0 inet from 10.0.0.7 to any -> 67.43.133.205
nat on tun0 inet from 10.0.0.8/29 to any -> 67.43.133.205
nat on tun0 inet from 10.0.0.16/28 to any -> 67.43.133.205
nat on tun0 inet from 10.0.0.32/27 to any -> 67.43.133.205
nat on tun0 inet from 192.168.1.0/24 to any -> 67.43.133.204
binat on tun0 inet from 10.0.0.2 to any -> 67.43.133.206
binat on tun0 inet from 10.0.0.3 to any -> 67.43.133.207
vs
# pfctl -sn
nat on tun0 inet from 192.168.10.0/24 to any -> (tun0:0)
nat on tun0 inet from <204network> to any -> 67.43.133.205
nat on tun0 inet from 192.168.1.0/24 to any -> 67.43.133.204
binat on tun0 inet from 10.0.0.2 to any -> 67.43.133.206
binat on tun0 inet from 10.0.0.3 to any -> 67.43.133.207
Kernel is 6.3-PRERELEASE FreeBSD 6.3-PRERELEASE #0: Fri Dec 14
15:02:59 EST 2007
I dont see anything new in the pf tree since then.
---Mike
--------------------------------------------------------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, [EMAIL PROTECTED]
Providing Internet since 1994 www.sentex.net
Cambridge, Ontario Canada www.sentex.net/mike
_______________________________________________
freebsd-pf@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
