does NATd _prevent_ use of stateful ipfw rules w/ keep-state?

[Luigi Rizzo]

On Wed, Jun 02, 2004 at 03:33:58PM -0700, OpenMacNews wrote:
> In continued digging for some guidance w.r.t. my earlier post, I came across the following list comment ...
> 
>         > The real show stopper is ipfw with stateful rules using the 'keep state'
>         > option does not work when used with the divert/nated legacy sub-routine.
>         > What this means is ipfw with stateful rules can only be used if
>         > 'user ppp -nat' is how you connect to the public internet.
> 
> Is this in fact true?
> If using NATd, am I relegated to a _static_ ruleset, w/ no ability to use stateful rules?

just about every sentence above is false.

nothing prevents you from using stateful ipfw rules with natd,
_but_ you must understand very well the packet's flow and how
addresses are transformed or you won't get what you want.

personally i see almost always only disadvantages (basically, it is much
easier to screw up your configuration) in using both because nat is
already stateful

	cheers
	luigi
> Richard
> _______________________________________________
> freebsd-ipfw at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe at freebsd.org"