On Mon, 19 Jan 2004, fbsd_user wrote: > That's a play on words. And still does not prove stateful rules work on > the interface facing the public internet. There is no documentation that > says keep-state and limit only works on the interface facing the private > Lan network. And the implied meaning is they are to be used on the > interface facing the public internet.
I just jumped in the middle here, so I may be out of context. But, stateful rules don't play nice with NAT. Consider non-NAT, a public IP address contacting an Internet address: 126.96.36.199 -> 188.8.131.52 A rule is created for 184.108.40.206 coming to 220.127.116.11. When 18.104.22.168 replies, the stateful rule lets it in. This is good. But consider NAT: 10.0.0.10 changed to 22.214.171.124 -> 126.96.36.199 If you do a keep-state before NAT, you have a rule to allow 188.8.131.52 to 10.0.0.10, but the return incoming packet will be 184.108.40.206 -> 220.127.116.11, so the rule doesn't match. If you do a keep-state after NAT, then you have a rule to allow 18.104.22.168 to 22.214.171.124. The return incoming packet matches that rule, but it accepts the packet and packet processing stops, so it's never passed through NAT, and never makes it back to 10.0.0.10. So as it stands now, I don't see that you can use stateful connections with NAT, unless check-state is changed to allow a packet to be passed through NAT. Ken Bolingbroke [EMAIL PROTECTED] _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"