natd & ipfw

[Lev Klimin]

Good morning!

I have 4.9-release. I'm interesting natd and ipfw.
My tested box have two interface 172.16.0.10/29 and 195.161.208.210/30.
# ifpw list
00500 divert 8668 ip from any to not 172.16.0.8/29
01000 allow ip from any to any

# natd -v -a 195.161.208.210

When I ping 195.161.208.130 from machine behind firewall (172.16.0.9)
I see.
In  [ICMP] [ICMP] 172.16.0.9 -> 195.161.208.130 8(0) aliased to
           [ICMP] 172.16.0.9 -> 195.161.208.130 8(0)
Out [ICMP] [ICMP] 172.16.0.9 -> 195.161.208.130 8(0) aliased to
           [ICMP] 195.161.208.210 -> 195.161.208.130 8(0)

ICMP packet flow through filter in two place: in ip_in and ip_out. It
diverted to natd twice. Why in first it's source address doesn't change,
but only in ip_out? If I do following
00500 divert 8668 ip from any to not 172.16.0.8/29 in
then natd don't change source address, and ping don't work. I thinked
that natd must do NAT whenever and wherever it work. May I be
mistaken?

Sorry for the trivial question, but I'm not a expert in FreeBSD, I'm only studying.

Thank you.

-- 
Lev Klimin                           mailto:levanty at mari-el.ru
(8362) 42-15-49
19:37:26 2 декабря 2003 г.