How to set up ipfw(8) NAT between an alias and the main IP address, when the alias is in another network?

[Michael Sierchio]

NAT is already maintaining state – it is possible to combine stateful rules
and NAT, but don't. ;-)

Are you really proposing to NAT twice, or is 192.168.1.2 a phony address
for the purposes of discussion here?

In any case, consider something like the following:

#!/bin/sh

fw="/sbin/ipfw -q"
sysctl net.inet.ip.fw.one_pass=0

IP_JAIL="192.168.100.2"
IP_EXIF="192.168.1.2"

OIF="sk0"

################################################################################
# If 192.168.1.2 is really your interface address, you'll be nat'ing twice
# on the way to the internet, which is ugly. You don't need the *unreg_only*
# directive if you only have  RFC1918 addresses anyway. You should clarify
# if this is the case. *reset* kills all active nat sessions if you run this
# script again.

$fw flush

$fw nat 1 config \
    redirect_addr ${IP_EXIF} ${IP_JAIL} \
    redirect_addr ${IP_JAIL} ${IP_EXIF} \
    if ${OIF} unreg_only reset

################################################################################
# separate in and out as a matter of habit - don't mention protocol in nat
# statement, do this in subsequent rules

$fw add 01000 nat 1 ip from any to any in recv ${OIF}

# check-state isn't needed, really, since it gets performed at the next
# rule that mentions state

#$#$#$#$# $fw add 01500 check-state

# these will match traffic to/from external IP and not jail

$fw add 02000 allow tcp  from ${IP_EXIF} to any out setup keep-state
$fw add 02010 allow udp  from ${IP_EXIF} to any out keep-state
$fw add 02020 allow icmp from ${IP_EXIF} to any out keep-state

################################################################################
# Why is this safe? because it will only match NAT return packets.
# It only permits traffic to your jail in this case. Also, for TCP to
# function properly, to need to accept ICMP error messages, esp. need-frag

$fw add 02000 allow ip from any to ${IP_JAIL}

################################################################################
# outbound packets pass through nat

$fw add 03000 nat 1 ip from any to any out xmit ${OIF}

################################################################################
# if your default rule (65535) is DENY, you need something like this. This
will
# match only NAT'd traffic

$fw add 50000 allow ip from any to any out xmit ${OIF}



On Sat, Jul 6, 2019 at 1:03 AM Yuri <yuri at rawbw.com> wrote:

> My network interface looks like this:
>
> sk0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
>      options=80009<RXCSUM,VLAN_MTU,LINKSTATE>
>      ether 01:3c:47:8a:17:12
>      inet 192.168.1.2 netmask 0xffffff00 broadcast 192.168.1.255
>      inet 192.168.100.2 netmask 0xffffffff broadcast 192.168.100.2
>      media: Ethernet autoselect (100baseTX <full-duplex>)
>      status: active
>      nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
>
> The second IP address is an alias that is used for jail.
>
> I would like to set up NAT so that this jail would access the internet
> through the same interface.
>
>
> I tried this script:
>
>
> fw="/sbin/ipfw -q"
>
> $fw nat 1 config redirect_addr 192.168.100.2 192.168.1.2 redirect_addr
> 192.168.1.2 192.168.100.2 if sk0 unreg_only reset
>
> $fw add 1001 nat 1 tcp from 192.168.100.2/32 to any via sk0 keep-state
>
> $fw add 1002 check-state
>
>
> The rule 1001 has keep-state, therefore it should process both outgoing
> tcp and incoming response packets. But the outbound packets are NATted,
> but the inbound ones are not.
>
> What is wrong, and how to fix this script?
>
>
> Thank you,
>
> Yuri
>
>
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>


-- 

"Well," Brahmā said, "even after ten thousand explanations, a fool is no
wiser, but an intelligent person requires only two thousand five hundred."

- The Mahābhārata