disabling implicit creation of state for NAT, BINAT and RDR
daniel at benzedrine.cx
Tue Oct 23 23:59:41 PDT 2007
On Wed, Oct 24, 2007 at 01:50:55PM +0800, Nex Mon wrote:
> hello, is there a way to disable implicit creation of states for NAT, BINAT
> and RDR rules? the man page of pf.conf says this:
> Note: nat, binat and rdr rules implicitly create state for connections.
Yes, translations require states.
Imagine you have a connection from
Client Gateway External
10.1.2.3 -> 18.104.22.168 -> 22.214.171.124
i.e. the client 10.1.2.3 sends a TCP SYN to external server
126.96.36.199. The NAT gateway replaces the source address with
Now the external server sends a TCP SYN+ACK back to 188.8.131.52.
How would the gateway know that this packet is for 10.1.2.3, and needs
the destination address translated back to 10.1.2.3, without a state
The state entry is the only part that holds this mapping information.
More information about the freebsd-pf