Freddie Cash wrote: >> This seemed to NAT packets outbound correctly, but the replies were >> never NAT'd back to the private IPs. I believe the presence of the >> bridge affects ipfw's ability to divert the appropriate packets. This >> configuration partly works: >> divert natd any from 192.168.1.0/24 to any >> divert natd any from any to <public IP>
> Have you tried restricting your rules to only the vr1 interfaces, with > <public IP> configured directly on vr1: > > divert natd ip from 192.168.1.0/24 to any out xmit vr1 > divert natd ip from any to <public IP> in recv vr1 Ah, there are recv/xmit semantics as well as in/out. I need to read the man page more thoroughly! However, this doesn't seem to work. It has the same symptoms as a single 'any to any via vr1' diversion: outbound packets are rewritten correctly (verified at the destination) but the replies are never rewritten. 00601 3 180 divert 8668 ip from 192.168.1.0/24 to any out xmit vr1 00602 0 0 divert 8668 ip from any to <public ip> in recv vr1 Nothing ever reaches the second rule. I think the bridge changes ipfw filtering properties, because the simple 'any to any via vr1' is mentioned a lot in the literature. It just doesn't work here? -- Jay L. T. Cornwall http://www.jcornwall.me.uk/ _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw To unsubscribe, send any mail to "[EMAIL PROTECTED]"
