IPFW - Two External Interfaces

[vladone]

Hello PFS,

Friday, May 19, 2006, 6:53:57 AM, you wrote:

> On 5/16/06, Matthew <drinking.coffee at gmail.com> wrote:
>> I recommend you install tcptraceroute:    /usr/ports/net/tcptraceroute/
>>
>> tcptraceroute will let you specify the interface so you can test your
>> configuration.
>>
>> For example, I have a FWD rule:
>> ipfw add 420 fwd 192.168.10.10 tcp  from 84.16.244.0/24 to any
>>
>> [root at c3p0][~]$ tcptraceroute -s 84.16.244.178 -i gif0 www.google.com
>> Selected device gif0, address 84.16.244.178, port 12154 for outgoing packets
>> Tracing the path to www.google.com (72.14.203.99) on TCP port 80, 30 hops
>> max
>>  1  192.168.10.10 (192.168.10.10)  107.013 ms  106.731 ms  106.697 ms
>>  2  fragw.gatewayrouter.net (84.16.224.1)  107.287 ms  107.211 ms  107.352
>> ms
>>  3  fragw1.gatewayrouter.net (217.20.117.10)  106.937 ms  107.240 ms
>> 106.986 ms
>>  4  rtr-1.decix-germany.eweka.nl (80.81.192.224)  107.090 ms  107.509 ms
>> 107.103 ms
>>
>> -- Matthew
>>
>>

> This really highlights my problem that traffic with a source ip of
> 192.168.1.1 isn't being forwarded properly to 192.168.1.254. I have
> removed all my NAT related rules for testing and have just the
> following:

> ipfw -f flush
> ipfw -f pipe flush

> ipfw add fwd 192.168.1.254 tcp from 192.168.1.1 to any

> ipfw add allow all from any to any



> When I do a tcptraceroute as outlined above:

> $sudo tcptraceroute -s 192.168.1.1 -i em0 google.com
> Selected device em0, address 192.168.1.1, port 56472 for outgoing packets
> Tracing the path to google.com (72.14.207.99) on TCP port 80, 30 hops max
>  1  * * *

> I get nowhere.

> I can get out just fine on bge1, since 192.168.2.254 is my default
> gateway on the machine.

> I am starting to feel like the fwd directive is simply broken on this
> machine... Could there be some kernel options that I'm missing? Are
> there any other places I should look for something silly that might be
> breaking forward? Again, this did in fact work with pf on this
> machine, due to "policy" I need to get it working in ipfw.

> Jared Baldridge
> _______________________________________________
> freebsd-ipfw at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to
> "freebsd-ipfw-unsubscribe at freebsd.org"

And again from man ipfw:
"
 ..............
If ipaddr is not a local address, then the port number (if speci-
fied) is ignored, and the packet will be forwarded to the remote
address, using the route as found in the local routing table for
that IP.
...............
"
so, again about route's.

-- 
Best regards,
 vladone                            mailto:vladone at spaingsm.com