ipfw3

Mon Jun 22 08:38:28 PDT 2015

--------------------------------------------
bycn82 <bycn82 at gmail.com> schrieb am Mo, 22.6.2015:

 Betreff: Re: ipfw3
 An: nans_nans1 at yahoo.de
 CC: "users at dragonflybsd.org" <users at dragonflybsd.org>
 Datum: Montag, 22. Juni, 2015 17:27 Uhr

 yes,
 if you are
 using the latest DragonflyBSD source,then you can
 print the NAT records like "ip show nat
 translation" on cisco routers. 
 On 22 June 2015 at 23:22, 
 <nans_nans1 at yahoo.de>
 wrote:
 That is a
 good question. Is "tcpdump -nettti bnx1" the right
 command to verify this?

yes, you are right: There is no traffic out via bnx1.
It's for a business company. So no teamviewer is possible.

Is there anything else what could be wrong, maybe in rc.conf?
What about natd_enable ?

 --------------------------------------------

 bycn82 <bycn82 at gmail.com>
 schrieb am Mo, 22.6.2015:

  Betreff: Re: ipfw3

  An: nans_nans1 at yahoo.de

  Datum: Montag, 22. Juni, 2015 17:11 Uhr

  but do you

  have any traffic go out via bnx1 ?

  On 22 June 2015 at 23:08,

  <nans_nans1 at yahoo.de>

  wrote:

  ok. i try it on another machine with

  4.3 and without the options in kernel config. The result
 is

  the same.

  Some data:

  Internal NIC: bnx0, 192.168.100.188/24

  External NIC: bnx1, 192.168.10.229/24

  rc.conf:

  gateway_enable="YES"

  defaultrouter="192.168.10.200"

  Then:

  kldload ipfw3_nat

  ipfw3 nat 1 config if bnx1

  ipfw3 add nat 1 tcp via bnx1

  The outputs:

  kldstat:

  kernel

  acpi.ko

  ehci.ko

  xhci.ko

  ipfw3_nat.ko

  ipfw3_basic.ko

  ipfw3.ko

  libalias.ko

  ipfw3 show:

  00100   0   0   nat 1 tcp via bnx1

  65535  699  51067  deny

  ipfw3 nat show config:

  ipfw nat 1 config if bnx1

  Is something wrong?

  --------------------------------------------

  bycn82 <bycn82 at gmail.com>

  schrieb am Mo, 22.6.2015:

   Betreff: Re: ipfw3

   An: nans_nans1 at yahoo.de

   CC: "users at dragonflybsd.org"

  <users at dragonflybsd.org>

   Datum: Montag, 22.

  Juni, 2015 15:33 Uhr

   your rules

   are correct.and you

   don't need to add the

  options in kernel config file,

   that belongs to IPFW

   please provide

   output of below commands:1.

   kldstat2. ipfw3

   show3. ipfw3 nat

   show config

   On 22 June 2015 at 21:08,

   <nans_nans1 at yahoo.de>

   wrote:

   Sorry,

   but this dont work.

   My external nic is ue0 and my internal nic is em0.

   I run 4.3 and a kernel with the following options:

   options IPFIREWALL

   options IPDIVERT

   options IPFIREWALL_DEFAULT_TO_ACCEPT

   options IPFIREWALL_VERBOSE

   What i do:

   In /etc/rc.conf: gateway_enable="YES"

   Then:

   kldload ipfw3_nat

   ipfw3 nat 1 config if ue0

   ipfw3 add nat 1 tcp via ue0

   The result is that NAT don't work.

   What is wrong with my configuration? Have i forgotten

   something?

   --------------------------------------------

   bycn82 <bycn82 at gmail.com>

   schrieb am Mo, 22.6.2015:

    Betreff: Re: ipfw3

    An: nans_nans1 at yahoo.de

    CC: "users at dragonflybsd.org"

   <users at dragonflybsd.org>

    Datum: Montag, 22. Juni, 2015 01:47 Uhr

    hi,

    sorry for

    lacking of documentation. 

    below are

    sample steps to use in-kernel NAT with ipfw3.

    Step1:  make

    sure the ipfw3_nat module was loaded

    dev03#kldstat | grep

    ipfw3_nat 5    1 0xffffffff83242000

    3000     ipfw3_nat.ko

    if the modules was not loaded,

    then below command to load the kernel module

    dev03#kldload

    ipfw3_nat

    Step2: prepare

    NAT config

    dev03#ipfw3 nat 1 config

    if em0ipfw nat

    1 config if em0

    which

    means it will do MASQUERADE using interface

    em0.

    Step3: NAT the

    traffic.  NAT is just ip translate. so both

    direction should go through the same NAT

    config.

    dev03#ipfw3

    add nat 1 tcp via em0

    this means both in and out traffic

    on interface em0 will be filtered/ translated by
 NAT

   config

    id 1.

    hope this helps, please try it and

    if you have any question, just let me know, and

    if you can help to come up with an tutorial by

   rephrasing

    this and append with your experience, that would be

   very

    helpful.

    http://www.dragonflybsd.org/docs/ipfw2/

    is an wiki, there is a "edit page"

    link. 

    regards,bycn82

    On 22 June 2015 at 02:31,

    <nans_nans1 at yahoo.de>

    wrote:

    Can

    someone give me detailed/complete instructions how
 to

    realize simple working nat with ipfw3 (including

  rc.conf

   and

    configuration files).

    The informations on these sites turns out to be
 sadly

   sparse

    for me:

    https://www.dragonflybsd.org/docs/ipfw2/

    http://www.dragonflybsd.org/docs/ipfw2/modules/