How to set up ipfw(8) NAT between an alias and the main IP address, when the alias is in another network?

[Andrey V. Elsukov]

On 06.07.2019 11:01, Yuri wrote:
> My network interface looks like this:
> $fw nat 1 config redirect_addr 192.168.100.2 192.168.1.2 redirect_addr
> 192.168.1.2 192.168.100.2 if sk0 unreg_only reset
> 
> $fw add 1001 nat 1 tcp from 192.168.100.2/32 to any via sk0 keep-state
> 
> $fw add 1002 check-state
> 
> 
> The rule 1001 has keep-state, therefore it should process both outgoing
> tcp and incoming response packets. But the outbound packets are NATted,
> but the inbound ones are not.
> 
> What is wrong, and how to fix this script?

'keep-state' creates state for TCP connection that is not yet
translated, thus it won't handle the reply packet, that has translated
address/port.

-- 
WBR, Andrey V. Elsukov

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 554 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20190708/0350ba8b/attachment.sig>