pf or ipfw for NAT

[Frank Leonhardt]

For longer than I care to remember (FreeBSD 2)  I've implemented a
physical asymmetric nat gateway using natd and ipfw. I just do what the
user guide says and it works.

For everything else I tend to use pf because I understand it better than
ipfw. And I use pf and nat the virtual network between jails. When I say
I understand pf better, that's better than ipfw - it doesn't mean I
understand it well!

Am I using ipfw/natd for historical reasons? Can I do the same with pf?
I'm not entirely sure, but I assume natd is a counterpart to ipfw
whereas pf does packet filtering and nat and is a replacement for both.
The FreeBSD documentation favours ipfw.

I'd really appreciate it if someone could tell me what I need to put in
rc.conf and pf.conf to get this working. For example, do I need to
enable the gateway in rc.conf if not using ipfw? I'm guessing not, but
I'm only guessing.

I've seem some complex examples. I'm thinking of going with something
like this. I'm ASSUMING any incoming connections (e.g. ssh) would still
end up on the host running PF, except port 80.

If anyone could sanity check this I'd be very grateful.

----------------------------------------

rc.conf:

defaultrouter="1.2.3.1"
ifconfig_bge0="inet 1.2.3.4 netmask 255.255.255.192"
ifconfig_bge1="inet 192.168.1.1 netmask 255.255.255.0"

pf_enable="yes"

----------------------------------------

pf.conf:

scrub in all

nat pass on bge0 from 192.168.1.0/24  to any -> 1.2.3.4
# Never quite sure with pf - the following may be better
# nat on bge0 from bge1:network to any -> bge0

# Redirect port 80 to internal web server

rdr pass on bge0 proto tcp from any to 1.2.3.4  -> port 80 - 192.168.1.3


----------------------------------------

Thanks, Frank.

[Steve O'Hara-Smith]

On Fri, 2 Apr 2021 20:17:58 +0100

Post by Frank Leonhardt
For longer than I care to remember (FreeBSD 2)  I've implemented a
physical asymmetric nat gateway using natd and ipfw. I just do what the
user guide says and it works.

Yes it does and that's fine.

Post by Frank Leonhardt
Am I using ipfw/natd for historical reasons? Can I do the same with pf?

Yes you can the relevant line in my pf.conf is:

nat on $ext_if inet from !($ext_if) -> ($ext_if:0)

[Frank Leonhardt]

Post by Steve O'Hara-Smith
On Fri, 2 Apr 2021 20:17:58 +0100

Post by Frank Leonhardt
For longer than I care to remember (FreeBSD 2)  I've implemented a
physical asymmetric nat gateway using natd and ipfw. I just do what the
user guide says and it works.

Yes it does and that's fine.

Post by Frank Leonhardt
Am I using ipfw/natd for historical reasons? Can I do the same with pf?

nat on $ext_if inet from !($ext_if) -> ($ext_if:0)

Thanks Steve. Any idea whether I need to enable the gateway when using
pf instead?

e.g. sysctl net.inet.ip.forwarding=1

Thanks, Frank.

[Steve O'Hara-Smith]

On Fri, 2 Apr 2021 21:36:04 +0100

Post by Frank Leonhardt
Thanks Steve. Any idea whether I need to enable the gateway when using
pf instead?
e.g. sysctl net.inet.ip.forwarding=1

I'm pretty sure you do - TBH I've never tried not setting it on
anything that routes.

[Frank Leonhardt]

Post by Frank Leonhardt
Thanks Steve. Any idea whether I need to enable the gateway when using
pf instead?
e.g. sysctl net.inet.ip.forwarding=1

     I'm pretty sure you do - TBH I've never tried not setting it on
anything that routes.

I think so too. I set it and it works perfectly. I'm really wondering why I've bothered with natd - just using pf works a treat.

For the sake of anyone reading this thread in the future, this script starts the whole thing off (xxx is the external address):

sysctl net.inet.ip.forwarding=1

ifconfig bge0 inet 192.168.1.210 netmask 0xffffffff alias

ifconfig re0  inet xxx.xxx.xxx.xxx netmask 0xffffffff alias

service dhcpd onestart

service pf onestart

-----------------------------------------------------

This is what I'd put in rc.conf to make it permanent (but not a cut/paste job so may be errors):

gateway_enable=yes

ifconfig_bge0=" inet 192.168.1.210 netmask 0xffffffff alias"

ifconfig re0="inet xxx.xxx.xxx.xxx netmask 255.255.255.248"

dhcpd_enable=yes

pf_enable=yes

-----------------------------------------------------

/usr/local/etc/dhcpd.conf (important part):

subnet 192.168.1.0  netmask 255.255.255.0 {

  range 192.168.1.128 192.168.1.192;

   option routers 192.168.1.210;

   authoritative;

}
-----------------------------------------------------

/etc/pf.conf

scrub in all
# NAT bit
nat pass on re0 from 192.168.1.0/24 to any -> xxx.xxx.xxx.xxx
# Pass port 25 to mail server on LAN
rdr pass on re0 proto tcp from any to xxx.xxx.xxx.xxx port 25 -> 192.168.1.203

[Dewayne Geraghty]

On 12/04/2021 4:21 am, Frank Leonhardt wrote:
...

Post by Frank Leonhardt
I think so too. I set it and it works perfectly. I'm really wondering
why I've bothered with natd - just using pf works a treat.

You probably missed the creation of nat functionality in the kernel, via
options LIBALIAS
options IPFIREWALL_NAT

;)