[FUG-BR] Dúvida ipfw fwd

[N Guerra]

Acabei de pesquisar:

http://www.freebsd.org/doc/en/books/faq/networking.html#IPFW-FWD

12.18. Why is my ipfw “fwd” rule to redirect a service to another
machine not working?

Possibly because you want to do network address translation (NAT) and
not just forward packets. A “fwd” rule does exactly what it says; it
forwards packets. It does not actually change the data inside the
packet. Say we have a rule like:

01000 fwd 10.0.0.1 from any to foo 21
When a packet with a destination address of foo arrives at the machine
with this rule, the packet is forwarded to 10.0.0.1, but it still has
the destination address of foo! The destination address of the packet
is not changed to 10.0.0.1. Most machines would probably drop a packet
that they receive with a destination address that is not their own.
Therefore, using a “fwd” rule does not often work the way the user
expects. This behavior is a feature and not a bug.

See the FAQ about redirecting services, the natd(8) manual, or one of
the several port redirecting utilities in the Ports Collection for a
correct way to do this.

Aos conhecedores do PF, é possível esse redirect usando o PF ao invés do ipfw?

Obrigado,

Guerra


2009/11/15 N Guerra <nguerrajr at gmail.com>:
> Trober,
>
> Mas no meu caso a porta é 25 nas duas máquinas, não deveria funcionar?
>
> Obrigado,
>
> Guerra
>
>
> 2009/11/15 Trober <trober at trober.com>:
>>
>>> Pessoal,
>>>
>>> Tenho a seguinte situação:
>>>
>>> FreeBSD como firewall com 2 placas de rede:
>>>
>>> bge0: 200.10.10.2 --> link da operadora e gateway default também
>>> bge1: 200.200.200.1/26 --> rede interna do datacenter
>>>
>>> Temos 2 servidores de e-mail internos:
>>> 200.200.200.8 e 200.200.200.9
>>>
>>> Tentei rodar no firewall:
>>>
>>> ipfw add fwd 200.200.200.9,25 tcp from 187.10.10.10 to 200.200.200.8 25
>>>
>>> Ou seja, gostaria de desviar o tráfego do IP 187.10.10.10 p/ a porta
>>> 25 to 200.200.200.8 para o 200.200.200.9 na porta 25 também.
>>>
>>> Como fazer isso? Onde está errada a regra acima?
>>>
>>> Antes de colocar a regra do ipfw fwd, eu consigo fazer telnet para a
>>> porta 25 nos 2 servidores 200.200.200.8 e 200.200.200.9.
>>>
>>> --
>>>
>>> []s,
>>>
>>> Guerra
>>> -------------------------
>>>
>>
>> Salve Guerra!
>>
>> O equívoco está no uso do atributo "porta" no FWD. Quando o encaminhamento
>> (FWD) é feito para um destino não local, esse parâmetro é ignorado.
>>
>> A explicação está na documentação do IPFW[1], que destaco abaixo:
>>
>> "If ipaddr is a local address, then matching packets will be forwarded to
>> port (or the port number in the packet if one is not specified in the
>> rule) on the local machine.
>>
>> If ipaddr is not a local address, then the port number (if specified) is
>> ignored, and the packet will be forwarded to the remote address, using the
>> route as found in the local routing table for that IP."
>>
>> [1] http://www.freebsd.org/cgi/man.cgi?query=ipfw&sektion=8
>>
>> Saudações,
>>
>> Trober
>> -
>> -
>> -
>> -
>> -
>>
>>
>> -------------------------
>> Histórico: http://www.fug.com.br/historico/html/freebsd/
>> Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
>>
>
>
>
> --
>
> []s,
>
> Guerra
>



-- 

[]s,

Guerra