ipfw - accessing DMZ from LAN

[Marek Salwerowicz]

W dniu 2011-09-26 21:20, Freddie Cash pisze:
>
> Your rules are too generic, they will not work for a double-NAT setup.
> Each and every single rule must specify the network interface.  And it must
> specify whether it's incoming (in recv) or outgoing (out xmit) traffic.
>   Don't use "via" anywhere.
>
> While it's easier to use generic rules to start with, you really need to get
> very specific, at least for the double-NAT setup.
>
> See my example above.
>

I look at it but I have problems with understanding the rules.
So far I understand the double-NAT like:

1. There are two NAT instances, one for LAN, the other for DMZ host 
(with public address redirection to DMZ private IP). The first is 
$lanport, the other $dmzport. The LAN interface is $LANIF, the DMZ 
interface is $DMZIF

2. When client from LAN wants to connect to DMZ host, using DMZ public 
IP *only*, the packet goes like this:

     i. the packet is allowed to enter the router by DMZ NAT port 
($dmzport) and $LANIF:
         ipfw add divert $dmzport ip from $LAN to $DMZ_PUBLIC_IP in recv 
$LANIF
         ipfw add allow ip from $LAN to $DMZ_PUBLIC_IP in recv $LANIF 
<--- why in your example are you using PRIVATE_IP instead of PUBLIC?
     ii. the packet is redirected to go out to DMZ, using DMZ NAT port:
         ipfw add divert $dmzport ip from $LAN to $DMZ_PRIVATE_IP out 
xmit $DMZIF
         ipfw add allow ip from $ROUTER_PUBLIC_IP to $DMZ_PRIVATE_IP out 
xmit $DMZIF

3. When DMZ host wants to connect with LAN client:

     i. the packet goes to router by DMZ NAT port and $DMZIF:
         ipfw add divert $dmzport ip from $DMZ_PRIVATE_IP to 
$ROUTER_PUBLIC_IP in recv $DMZIF
         ipfw add allow ip from $DMZ_PRIVATE_IP to $LAN in recv $DMZIF
     ii. the packet is redirected to LAN (using _which_ NAT port? For 
LAN or DMZ? )
         ipfw add divert $lanport (I am *not* sure here) from 
$DMZ_PRIVATE_IP to $LAN out xmit $LANIF
         ipfw add allow ip from $DMZ_PUBLIC_IP to $LAN out xmit $LANIF

4. Is it OK ? What's the port in 3.ii step ?


If I want also to set up  NAT rules for my LAN (to allow it to access 
the Internet, and router), and also for my DMZ hosts (also for the 
Internet), what should be the order of rules?
First 'LAN-DMZ', then 'DMZ', then 'LAN' ?

Regards,

-- 
Marek Salwerowicz