How to set up ipfw(8) NAT between an alias and the main IP address, when the alias is in another network?

[Vinícius Zavam]

Am Sa., 6. Juli 2019 um 08:02 Uhr schrieb Yuri <yuri at rawbw.com>:

> My network interface looks like this:
>
> sk0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
>      options=80009<RXCSUM,VLAN_MTU,LINKSTATE>
>      ether 01:3c:47:8a:17:12
>      inet 192.168.1.2 netmask 0xffffff00 broadcast 192.168.1.255
>      inet 192.168.100.2 netmask 0xffffffff broadcast 192.168.100.2
>      media: Ethernet autoselect (100baseTX <full-duplex>)
>      status: active
>      nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
>
> The second IP address is an alias that is used for jail.
>
> I would like to set up NAT so that this jail would access the internet
> through the same interface.
>
>
> I tried this script:
>
>
> fw="/sbin/ipfw -q"
>
> $fw nat 1 config redirect_addr 192.168.100.2 192.168.1.2 redirect_addr
> 192.168.1.2 192.168.100.2 if sk0 unreg_only reset
>
> $fw add 1001 nat 1 tcp from 192.168.100.2/32 to any via sk0 keep-state
>
> $fw add 1002 check-state
>
>
> The rule 1001 has keep-state, therefore it should process both outgoing
> tcp and incoming response packets. But the outbound packets are NATted,
> but the inbound ones are not.
>
> What is wrong, and how to fix this script?
>
>
> Thank you,
>
> Yuri
>

jail ... ip4=inherit ?


-- 
Vinícius Zavam
keybase.io/egypcio