Packet flow through IPFW+IPF+IPNAT ?

[Vlad GALU]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 2 Jun 2003 10:43:07 -0400 (EDT)
Matthew George <mdg at secureworks.net> wrote:

> On Sat, 31 May 2003, Vandyuk Eugene wrote:
> 
> >    Hi.
> >
> >    On my FreeBSD 4.8 configured IPFW2+IPF+IPNAT and I use them all:
> >    - IPFW - traffic accounting, shaping, balancing and filtering;
> >    - IPFilter - policy routing;
> >    - IPNAT - masquerading.
> >    I want to know, how IP-packets flow through all of this components?
> > What's the path?
> >    incoming: IPFW Layer2 -> IPFW&Dummynet -> IPNAT -> IPFilter ?
> >    outgoing: IPFW Layer2 -> IPFW&Dummynet -> IPFilter -> IPNAT ?
> > Is this correct? Or IPNAT on the incoming packets run before IPFW L3:
> >    incoming: IPFW Layer2 -> IPNAT -> IPFW&Dummynet -> IPFilter ?
> > I think this path is more preferable, because IPFW always use not
> > masqueraded IP-headers.
> >
> > Any help appreciated.

	Example one: IPF is compiled in kernel, IPFW is a module. In this case
IPFW stands 'outside' of IPF.
	Example two: viceversa: the order in which they take action is reversed
too.
	IPNAT is always 'outside' IPF.

> > _______________________________________________
> > freebsd-security at freebsd.org mailing list
> > http://lists.freebsd.org/mailman/listinfo/freebsd-security
> > To unsubscribe, send any mail to
> > "freebsd-security-unsubscribe at freebsd.org"
> >
> 
> I have ipfw compiled in and run ipfilter as a kld
> 
> the way it works is ipfw -> ipnat -> ipfilter
> 
> ipnat and all state matching for ipfilter is performed prior to ruleset
> processing
> 
> -- 
> Matthew George
> SecureWorks Technical Operations
> 
> _______________________________________________
> freebsd-security at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe at freebsd.org"
> 


- -- 
Vlad Galu
Network Administrator VipNET Bucharest
tel: 021/3039940
email: vladg at vipnet.ro
web: http://www.vipnet.ro
PGP: http://mirapoint.vipnet.ro/public_key.pgp

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)

iD8DBQE+22OeBQlxy6GegvARArZcAKDna8UnnCFkI3QJmxYcEynliRYV5QCfSoJY
afb5pCCY5ZJpEfwKLs4oMYU=
=tR6I
-----END PGP SIGNATURE-----