Jim Are there any place with better than ipf-howto or ipnat man5 page NAT commands explanation ? Something like :
map "triggers" on packets leaving interface and changes for packets leaving interface src ip (and port if asked to) for replies entering interface dst ip (and port if asked to) rdr "triggers" on packets entering interface and changes for packets entering interface dst ip and port for replies leaving interface src ip and port bimap - ??? I was looking for something like that to find out if its ever possible (with ipfilter) to change both src [ip or port] and dst [ip or port] on the way in and accordingly on the way out ? Thanks ----- Original Message ----- From: "Jim Sandoz" <[EMAIL PROTECTED]> To: "Rob Nielsen" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Sunday, December 08, 2002 12:59 Subject: Re: Problems with rdr > > rob, > > this one is actually pretty straightforward... > > rdr (rewriting) takes place *before* ingress filtering. > so you need to write your ipf "pass in" rules appropriately. > > read through these threads... > http://marc.theaimsgroup.com/?l=ipfilter&m=101179250803382&w=2 > http://marc.theaimsgroup.com/?l=ipfilter&m=99608074705794&w=2 > http://marc.theaimsgroup.com/?l=ipfilter&m=99898624628175&w=2 > http://marc.theaimsgroup.com/?l=ipfilter&m=99552181624892&w=2 > http://marc.theaimsgroup.com/?l=ipfilter&m=101409568515510&w=2 > > and you'll clearly see why you need: > pass in quick on dmfe0 proto tcp from any to 10.0.0.3/32 \ > port = 3389 keep state > > jim > > > Rob Nielsen wrote: > > > Hi, > > > > I'm using ipfilter 3.4.30, and am having problems trying to get rdr to work. > > Here's my configuration: > > > > ipf.conf > > pass in quick on dmfe0 proto tcp from any to a.b.c.d/32 port = 3389 keep > > state > > > > ipnat.conf > > rdr dmfe0 a.b.c.d/32 port A-> 10.0.0.3 port A tcp > > > > When I scan the port with nmap, the port shows up as filtered. > > > > Thanks, > > > > Rob
