NAT with pf
Subject:   Incorrect Information in this Article
Date:   2003-12-14 22:38:36
From:   anonymous2
The information posted about NAT rdr is incorrect. The author says that, in order to allow connections from internal interfaces, all that is needed is to do a rdr from the internal interface as well as from the external interface.

However, this is incorrect, and only results in the packet going one way. The return packet is discarded, however, because it comes from the wrong ip:

On this page, it explains how to deal with this, and it is not trivial, although the correct lines are included here. The relevant paragraph that describes the issue is here, as well:

Adding a second redirection rule for the internal interface does not have the desired effect either. When the local client connects to the external address of the firewall, the initial packet of the TCP handshake reaches the firewall through the internal interface. The redirection rule does apply and the destination address gets replaced with that of the internal server. The packet gets forwarded back through the internal interface and reaches the internal server. But the source address has not been translated, and still contains the local client's address, so the server sends its replies directly to the client. The firewall never sees the reply and has no chance to properly reverse the translation. The client receives a reply from a source it never expected and drops it. The TCP handshake then fails and no connection can be established.

This is an issue that is a pain to deal with with ipfw (FreeBSD), as well, although I have fixed the issue there, too. I was ecstatic when I read that simply doing a rdr from the internal interface would work on pf without additional tweaking. However, it doesn't, and this article is misleading (unintentionally, I'm sure). I hope you will correct this error to save someone else the trouble of finding this out the hard way.


1 to 1 of 1
  1. Jacek Artymiak photo Incorrect Information in this Article
    2003-12-15 12:06:55  Jacek Artymiak | [View]

    • Thank you, Jacek
      2003-12-15 15:18:19  anonymous2 [View]

      • That "$tcp" should be "tcp"
        2003-12-15 15:19:29  anonymous2 [View]

        • That "$tcp" should be "tcp"
          2005-03-27 22:54:02  2MuchRiceMakesMeSick [View]

1 to 1 of 1