Pongthep Kulkrisada wrote: > Hi All, > > I have just subscribed to freebsd-questions and I have a question about ppp > -nat. > > I have 2 computers. One is running FreeBSD-7.0R, the other is running WinXP. > The host running FBSD7.0R has been connecting to the outside world using > user-ppp without any problem for very long. Now I want to share internet > access to the other host behind NAT through this FBSD host. > My FBSD machine has 2 interfaces i.e. > tun0 (connecting to ISP) with dynamic IP (of course) > fxp0 (for internal LAN) with static IP of 192.168.1.10 > My WinXP machine has 1 interface (internal LAN) with static IP of 192.168.1.11 > > Previously I have a router acting as a gateway for all machines behind NAT. > But now I want FBSD machine to work as a gateway. I have never done this > before. I tried some googling with reading ppp(8) and ipfw(8). And I tried > masquerading but it didn't work. I have plenty configuration files. But the > relevant configurations are listed here. > > /etc/rc.conf > # enable IP forwarding > gateway_enable="YES" > # previously I ran web-server, just disable it or comment it out, not sure > why! > #apache_enable="YES" > > On the host running WinXP, I set its gateway and DNS server to the IP of ppp > host i.e. 192.168.1.10. > > I then inserted the following line as the first rule in /etc/ipfw.rules. > /sbin/ipfw add allow all from any to any via fxp0 > (I know this rule is dangerous, but just for testing.) > > I then issue the ppp command. > [EMAIL PROTECTED]:~# ppp -background -nat myisp > > FBSD host (running ppp) can access anywhere but WinXP host can't. I learned > from some site explaining that ppp itself has the capability of IP > masquerading. And it does not require natd(8). So I don't mention about natd > here. > Anyone have a clue or who have done the correct configurations, please point > me out. > > Thank you in advance. > Pongthep > >
There are at least two ways that I know of to achieve this. One uses the ipfw firewall, the other the pf firewall. For the ipfw solution, look at the FreeBSD Handbook: http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-natd.html This worked fine for me, although I prefer to use pf. Here is how I setup pf (Adjust for your interfaces as necessary) My Internet interface is rl0, setup in rc.conf as: ifconfig_rl0="inet 192.168.0.100 netmask 255.255.255.0" My local interface is rl1, setup in rc.conf as: ifconfig_rl1="inet 192.168.1.100 netmask 255.255.255.0" (I also have a defaultrouter setting which probably does not apply to you) I have nameserver entries in /etc/resolv.conf (or setup your own DNS server if you wish) Use this settings in rc.conf for pf: pf_enable="YES" pflog_logfile="/var/log/pflog" pflog_flags="" pf_rules="/etc/pf.conf" pf_flags="" gateway_enable="YES" Run: # sysctl net.inet.ip.forwarding=1 # /etc/rc.d/routing restart Add net.inet.ip.forwarding=1 to /etc/sysctl.conf so it persists reboots Add the following rule to /etc/pf.conf nat pass on rl0 from rl1:network to any -> rl0 AFAIR, if rl0 has a dynamic address, you will have to write it with parentheses, like: nat pass on rl0 from rl1:network to any -> (rl0) (Note that in /etc/pf.conf translation rules like the above, are placed above filtering rules like pass or block etc) You may have to adjust /etc/pf.conf filtering rules, assuming you have any. Restart some services # /etc/rc.d/netif restart # /etc/rc.d/routing restart # /etc/rc.d/pf restart or simply reboot, and you should be set. Note that in your client machine, you should set gateway to point to your FreeBSD machine, but unless you are running your own DNS server, DNS entries should point to your ISP. If you combine this setup with a DHCP server from the Ports Collection, you will have pretty much a standard home router out of a FreeBSD machine. There are also other capabilities, like port forwarding and so on, but I'll let you figure them out yourself ;) _______________________________________________ firstname.lastname@example.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"