ipf + ipnat + dmz + bridge question
Nelis Lamprecht
nelis at 8ball.co.za
Thu Feb 5 22:16:15 PST 2004
On Thu, 2004-02-05 at 15:04, Jason Lavigne wrote:
> Clever. I tried that and now I have found a different issue, I don't
> know if ipnat is working correctly, I can browse the internet using my
> LAN however the ipnat.rules are being completely ignored, I removed all
> rules and I can still browse the Internet with my LAN and to me this is
> odd.
>
> Any ideas?
Just one.
Besides the usual kernel tunes the most important one for ipf to
successfully work is IP Forwarding. Make sure you have this enabled.
sysctl net.inet.ip.forwarding=1
>
> Thanks for your time.
>
> Jay
>
> -----Original Message-----
> From: Nelis Lamprecht [mailto:nelis at 8ball.co.za]
> Sent: Thursday, February 05, 2004 3:47 AM
> To: Jason Lavigne
> Cc: FreeBSD Questions Mail List
> Subject: Re: ipf + ipnat + dmz + bridge question
>
> On Thu, 2004-02-05 at 02:57, Jason Lavigne wrote:
> > Hello all,
> >
> > I currently have a firewall with 3 nics, one goes to the net, one to
> the
> > DMZ and one to the LAN. I have ipf and ipnat running along with
> FreeBSD
> > bridge support and I have the external nic and the DMZ nic bridged.
> All
> > DMZ computers are configured with a real public ip and have the
> firewall
> > as the gateway.
> >
> > My question is when any computer from my DMZ goes out to the net it
> uses
> > the ip of the firewall and not the public ip it was assigned.
> Internally
> > within the DMZ they use the correct ips. How can I make it so when the
> > DMZ computers are on the net they report as using their assigned ip.
> Is
> > the DMZ using ipnat? I only have the LAN mapped in ipnat.rules and
> > nothing about the DMZ ips.
> >
> > TIA
> >
> > Jay
> >
> > Here are my configs:
> >
> > ifconfig
> >
> > dc0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> > inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
> > inet6 fe80::203:6dff:fe00:9bd%dc0 prefixlen 64 scopeid 0x1
> > ether 00:03:6d:00:09:bd
> > media: Ethernet autoselect (100baseTX)
> > status: active
> > dc1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu
> 1500
> > inet6 fe80::280:c6ff:feea:7af1%dc1 prefixlen 64 scopeid 0x2
> > inet xxx.yyy.200.99 netmask 0xfffffff0 broadcast
> xxx.yyy.200.111
> > ether 00:80:c6:ea:7a:f1
> > media: Ethernet autoselect (100baseTX <full-duplex>)
> > status: active
> > xl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu
> 1500
> > options=3<RXCSUM,TXCSUM>
> > inet6 fe80::250:daff:fe1b:90c3%xl0 prefixlen 64 scopeid 0x3
> > inet xxx.yyy.200.106 netmask 0xffffffff broadcast
> > xxx.yyy.200.106
> > inet xxx.yyy.200.107 netmask 0xffffffff broadcast
> > xxx.yyy.200.107
> > ether 00:50:da:1b:90:c3
> > media: Ethernet autoselect (10baseT/UTP)
> > status: active
> > lp0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
> > lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
> > inet6 ::1 prefixlen 128
> > inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
> > inet 127.0.0.1 netmask 0xff000000
> > tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1492
> > inet xxx.yyy.200.97 --> 207.136.64.4 netmask 0xffffff00
> > Opened by PID 241
> >
> > /etc/ipnat.rules
> >
> > # nat the lan
> > map xl0 192.168.1.0/24 -> xxx.yyy.200.97/32
>
> try changing this to:
>
> map xl0 from 192.168.1.0/24 ! to xxx.yyy.200.99/32 -> xxx.yyy.200.97/32
>
> which basically tells ipnat to always use NAT unless you are speaking
> with your DMZ xxx.yyy.200.99/32
>
>
> Regards,
--
Nelis Lamprecht
PGP: http://www.8ball.co.za/pgp/nelis.key
"Unix IS user friendly.. It's just selective about who its friends are."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20040206/27b4c8ea/attachment.bin
More information about the freebsd-questions
mailing list