summaryrefslogtreecommitdiffstats
path: root/etc/rc.firewall
diff options
context:
space:
mode:
authorpiso <piso@FreeBSD.org>2006-12-29 21:59:17 +0000
committerpiso <piso@FreeBSD.org>2006-12-29 21:59:17 +0000
commit0db606a3b135b207a944e841f0142c30f4f43ceb (patch)
tree69ec3c3af60d727edf88005d9af7a9beb78e73fe /etc/rc.firewall
parentd392a291a28a8cbedf2cc9398d4a03c8467d8c3d (diff)
downloadFreeBSD-src-0db606a3b135b207a944e841f0142c30f4f43ceb.zip
FreeBSD-src-0db606a3b135b207a944e841f0142c30f4f43ceb.tar.gz
Summer of Code 2005: improve libalias - part 2 of 2
With the second (and last) part of my previous Summer of Code work, we get: -ipfw's in kernel nat -redirect_* and LSNAT support General information about nat syntax and some examples are available in the ipfw (8) man page. The redirect and LSNAT syntax are identical to natd, so please refer to natd (8) man page. To enable in kernel nat in rc.conf, two options were added: o firewall_nat_enable: equivalent to natd_enable o firewall_nat_interface: equivalent to natd_interface Remember to set net.inet.ip.fw.one_pass to 0, if you want the packet to continue being checked by the firewall ruleset after being (de)aliased. NOTA BENE: due to some problems with libalias architecture, in kernel nat won't work with TSO enabled nic, thus you have to disable TSO via ifconfig (ifconfig foo0 -tso). Approved by: glebius (mentor)
Diffstat (limited to 'etc/rc.firewall')
-rw-r--r--etc/rc.firewall8
1 files changed, 8 insertions, 0 deletions
diff --git a/etc/rc.firewall b/etc/rc.firewall
index 132df9c..f569653 100644
--- a/etc/rc.firewall
+++ b/etc/rc.firewall
@@ -129,6 +129,14 @@ case ${firewall_type} in
fi
;;
esac
+ case ${firewall_nat_enable} in
+ [Yy][Ee][Ss])
+ if [ -n "${firewall_nat_interface}" ]; then
+ ${fwcmd} nat 123 config if ${firewall_nat_interface} log
+ ${fwcmd} add 50 nat 123 ip4 from any to any via ${firewall_nat_interface}
+ fi
+ ;;
+ esac
esac
############
OpenPOWER on IntegriCloud