Kernel Config for NAT

[Robert Huff]

Ian Smith writes:

>   > 	So ... double-checking I'm doing this right:
>   > 
>   > 1) in /boot/loader.conf:
>   > 
>   > ipfw_load="YES"
>   > ipdivert_load="YES"
>  
>  I thought from your earlier mail that you wanted to use in-kernel
>  NAT?

	I want whatever works.  :-)
	Beyond that ... all other things being more-or-less equal I'll
do this with modules.
	Let's build that.  So in /etc/sysctl.conf:

net.inet.ip.fw.default_to_accept="1"
net.inet.ip.fw.verbose="1"
net.inet.ip.fw.verbose_limit="100"

	check.

>  I believe all these can be accomplished with modules on GENERIC
>  kernel, at least on 8.x, with the exception of FIREWALL_FORWARD
>  functionality which does require a custom kernel as it messes
>  with lots of ip paths.

	This machine has a custom kernel, so that's not a an issue.
	And in /boot/loader.conf:

ipfw_load="YES"
ipfw_nat="YES"	# in-kernel ipfw nat
libalias="YES"	# for in-kernel ipfw nat

	check.
	and in the kernel config:

#options  IPFIREWALL              #firewall
#options  IPFIREWALL_VERBOSE      #enable logging to syslogd(8)

options  IPFIREWALL_FORWARD

#options  IPFIREWALL_VERBOSE_LIMIT=100    #limit verbosity
#options  IPFIREWALL_DEFAULT_TO_ACCEPT    #allow everything by default
#options  IPDIVERT
#options  IPFIREWALL_NAT          #ipfw kernel nat support
#options  LIBALIAS				# required for NAT

	check.
	This combination will get me a) ipfw, using the standard
rc.conf "firewall_" variables, and b) NAT ... do I still need to
have a "nat" setting in the firewall rules?

	Less confused than last time,


				Robert Huff