proxies and firewalls

JJB Barbish3 at
Mon Feb 2 10:05:14 PST 2004

Thanks for the detailed explanation.
The light bulb has turned on in my head.
I learn something new all the time on this list.

So let me put this in my own words to verify I understand correctly.
Lets say I have gateway box running 5 PCs on LAN behind it,
with cable dhcp connection to ISP.
The gateway box runs IPFILTER firewall and IPNAT to do NAT function.

I can discontinue using IPNAT and install an application level proxy
server on my gateway box and it will by default intercept all LAN
and gateway originating packet traffic destine for the public
internet after it's processed by my firewall and handle the
bi-directional traffic transparently?

-----Original Message-----
From: jan.muenther at [mailto:jan.muenther at]
Sent: Monday, February 02, 2004 12:02 PM
Cc: Jorn Argelo; questions at
Subject: Re: proxies and firewalls

> I have Lan with private ip address that send packets to
> public internet. How does an proxy server solve the private ip
> address versus my public ip address problem?

Simply through not routing / NATting at all.

Instead of just forwarding the packets rewriting the IP headers like
device does, an application layer proxy does the connections to the
world *INSTEAD* of the client.

To use the popular example of HTTP:
While a NAT device will just forward and rewrite your query to a
port 80/TCP and then forward and rewrite the reply according to its
connection table, an application layer proxy will do the query
*itself*. It
will then process the reply, identify whether it looks like HTML
matches its quality/security requirements and then give a friendly
reply to
the client that originally did the query.

Again, the proxy itself plays client on the application layer.

This of course means that all outgoing connections are also done
with the
external IP address of the application level proxy machine.

Clear now?

More information about the freebsd-questions mailing list