ipf + ipnat + dmz + bridge question
jlavigne at bwlogic.com
Fri Feb 6 04:10:14 PST 2004
Yep, got that. I am confused as to why my ipnat rules are being ignored.
How else could my LAN be accessing the Internet?
From: Nelis Lamprecht [mailto:nelis at 8ball.co.za]
Sent: Friday, February 06, 2004 1:16 AM
To: Jason Lavigne
Cc: 'FreeBSD Questions Mail List'
Subject: RE: ipf + ipnat + dmz + bridge question
On Thu, 2004-02-05 at 15:04, Jason Lavigne wrote:
> Clever. I tried that and now I have found a different issue, I don't
> know if ipnat is working correctly, I can browse the internet using my
> LAN however the ipnat.rules are being completely ignored, I removed
> rules and I can still browse the Internet with my LAN and to me this
> Any ideas?
Besides the usual kernel tunes the most important one for ipf to
successfully work is IP Forwarding. Make sure you have this enabled.
> Thanks for your time.
> -----Original Message-----
> From: Nelis Lamprecht [mailto:nelis at 8ball.co.za]
> Sent: Thursday, February 05, 2004 3:47 AM
> To: Jason Lavigne
> Cc: FreeBSD Questions Mail List
> Subject: Re: ipf + ipnat + dmz + bridge question
> On Thu, 2004-02-05 at 02:57, Jason Lavigne wrote:
> > Hello all,
> > I currently have a firewall with 3 nics, one goes to the net, one to
> > DMZ and one to the LAN. I have ipf and ipnat running along with
> > bridge support and I have the external nic and the DMZ nic bridged.
> > DMZ computers are configured with a real public ip and have the
> > as the gateway.
> > My question is when any computer from my DMZ goes out to the net it
> > the ip of the firewall and not the public ip it was assigned.
> > within the DMZ they use the correct ips. How can I make it so when
> > DMZ computers are on the net they report as using their assigned ip.
> > the DMZ using ipnat? I only have the LAN mapped in ipnat.rules and
> > nothing about the DMZ ips.
> > TIA
> > Jay
> > Here are my configs:
> > ifconfig
> > dc0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> > inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
> > inet6 fe80::203:6dff:fe00:9bd%dc0 prefixlen 64 scopeid 0x1
> > ether 00:03:6d:00:09:bd
> > media: Ethernet autoselect (100baseTX)
> > status: active
> > dc1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu
> > inet6 fe80::280:c6ff:feea:7af1%dc1 prefixlen 64 scopeid 0x2
> > inet xxx.yyy.200.99 netmask 0xfffffff0 broadcast
> > ether 00:80:c6:ea:7a:f1
> > media: Ethernet autoselect (100baseTX <full-duplex>)
> > status: active
> > xl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu
> > options=3<RXCSUM,TXCSUM>
> > inet6 fe80::250:daff:fe1b:90c3%xl0 prefixlen 64 scopeid 0x3
> > inet xxx.yyy.200.106 netmask 0xffffffff broadcast
> > xxx.yyy.200.106
> > inet xxx.yyy.200.107 netmask 0xffffffff broadcast
> > xxx.yyy.200.107
> > ether 00:50:da:1b:90:c3
> > media: Ethernet autoselect (10baseT/UTP)
> > status: active
> > lp0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
> > lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
> > inet6 ::1 prefixlen 128
> > inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
> > inet 127.0.0.1 netmask 0xff000000
> > tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1492
> > inet xxx.yyy.200.97 --> 184.108.40.206 netmask 0xffffff00
> > Opened by PID 241
> > /etc/ipnat.rules
> > # nat the lan
> > map xl0 192.168.1.0/24 -> xxx.yyy.200.97/32
> try changing this to:
> map xl0 from 192.168.1.0/24 ! to xxx.yyy.200.99/32 ->
> which basically tells ipnat to always use NAT unless you are speaking
> with your DMZ xxx.yyy.200.99/32
"Unix IS user friendly.. It's just selective about who its friends are."
More information about the freebsd-questions