Routing return NAT traffic based on interface

[David DeSimone]

Kevin Wilcox <kevin.wilcox at gmail.com> wrote:
>
> On Nov 19, 2012 5:54 PM, "Kevin Wilcox" <kevin.wilcox at gmail.com> wrote:
> 
> > It is. The "pass in" rule I used in my example assumes the inside
> > interface and the other devices it talks to are in the same network.
>
> Correction, the "pass in" and "nat" rules, not just the pass. They
> both have to be modified.

If I understand what you're proposing, it would be:

    nat on $ext_if from $int_if:network to any -> $ext_if
    pass in on $int_if from $int_if:network to any keep state
    pass out on $ext_if from any to any keep state

changed to this:

    nat on $ext_if from any to any -> $ext_if
    pass in on $int_if from any to any keep state
    pass out on $ext_if from any to any keep state

This doesn't seem right, because even traffic coming in via the external
interface will have its target IP changed to be the router, even if
it is destined for some other place.  Previously you were using "from
$int_if:network" to prevent this from happening to other traffic, but
without that restriction, every packet would be subject to NAT.

If I understand the poster's problem, it is that there could be whole
worlds of other networks behind $int_if, and he is not able to predict
what IP addresses should be used to match that traffic; in fact, it is
merely the fact that the traffic is arriving on $int_if that indicates
it shoudl be NAT'd.

What I'd suggest is that packet marking be used to mark packets arriving
via $int_if, and then apply NAT to the packets that flow to $ext_if:

    nat on $ext_if  tagged NAT  -> $ext_if

    pass in  on $int_if   tag NAT
    pass out on $ext_if

Untested configuration idea, of course.  :)

-- 
David DeSimone == Network Admin == fox at verio.net
  "I don't like spinach, and I'm glad I don't, because if I
   liked it I'd eat it, and I just hate it." -- Clarence Darrow


This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free.  Thank you.