How abuot firewall_nat_rules?

[KIRIYAMA Kazuhiko]

Hi stable list,

Now ipfw_nat's rules must be write directly in firewall_nat_flags. This is
messy to describe many rules. firewall_nat_rules will be treat smartly.
To enable firewall_nat_rules,apply following patch to /etc/rc.firewall

--- /etc/rc.firewall.org 2013-05-11 08:23:13.000000000 +0900
+++ /etc/rc.firewall 2013-05-11 08:29:11.000000000 +0900
@@ -162,6 +162,9 @@
case ${firewall_nat_enable} in
[Yy][Ee][Ss])
if [ -n "${firewall_nat_interface}" ]; then
+ if [ -r "${firewall_nat_rules}" ]; then
+ firewall_nat_flags="${firewall_nat_flags} `cat ${firewall_nat_rules}`"
+ fi
if echo "${firewall_nat_interface}" | \
grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; then
firewall_nat_flags="ip ${firewall_nat_interface} ${firewall_nat_flags}"


and then put in /etc/rc.conf

firewall_enable="YES"
firewall_type="OPEN"
firewall_nat_enable="YES"
firewall_nat_interface="X.X.X.X"
firewall_nat_flags="deny_in reset same_ports unreg_only"
firewall_nat_rules="/etc/ipfw_nat.rules"

where X.X.X.X is the outgoing global address and firewall_nat_rules specfies
the file in which describe ipfw_nat's rules, actually ipfw arguments
following to "${fwcmd} nat 123 config log" for example

redirect_port tcp 192.168.1.7:2401 2401
redirect_port tcp 192.168.1.5:80 80
redirect_port tcp 192.168.1.1:22 22069
redirect_port tcp 192.168.1.2:22 22053
redirect_port tcp 192.168.1.3:22 22025
redirect_port tcp 192.168.1.4:22 22080
redirect_port tcp 192.168.1.5:22 22021
redirect_port tcp 192.168.1.6:22 22067
redirect_port tcp 192.168.1.7:22 22401
redirect_port tcp 192.168.1.8:22 22081
redirect_port tcp 192.168.1.32:9100 63189
redirect_port tcp 192.168.1.252:9100 23089
redirect_port tcp 192.168.1.254:22 22

Regards
---
ki...@openedu.org
_______________________________________________
freebsd...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stabl...@freebsd.org"