My trouble is the following in FreeBSD 7. I use kernel nat + ipfw.
ipfw nat 73 config ip x.x.x.x redirect_port ...
ipfw nat 225 config ip y.y.y.y redirect_port ...
...
ipfw table 3 add m.m.m.m 73
ipfw table 3 add n.n.n.n 225
ipfw table 4 add m.m.m.m mg.mg.mg.mg
ipfw table 4 add n.n.n.n ng.ng.ng.ng
...
further I put at command line the following command
ipfw add 300 nat tablearg ip from table\(3\) to any
and receive the following unexpected answer from freebsd
300 nat 0 ip from table(3) to any
Word "tablearg" converted to "0". The most pity that system work with this rule just as system take it - using "0", i.e. do nothing for all packets, because I haven't the nat 0.
But
ipfw add 400 fwd tablearg ip from table\(4\) to any
give expected result in system answer:
400 fwd tablearg ip from table(4) to any
and in reaction on matched packets.
I changed my rule to many rules:
ipfw add 300 nat 73 ip from table\(3,73\) to any
ipfw add 300 nat 225 ip from table\(3,225\) to any
and so on and this is working, but quantity of rules in the real system increased terribly.
Why may ipfw nat tablearg not work correctly ?
ipfw nat 73 config ip x.x.x.x redirect_port ...
ipfw nat 225 config ip y.y.y.y redirect_port ...
...
ipfw table 3 add m.m.m.m 73
ipfw table 3 add n.n.n.n 225
ipfw table 4 add m.m.m.m mg.mg.mg.mg
ipfw table 4 add n.n.n.n ng.ng.ng.ng
...
further I put at command line the following command
ipfw add 300 nat tablearg ip from table\(3\) to any
and receive the following unexpected answer from freebsd
300 nat 0 ip from table(3) to any
Word "tablearg" converted to "0". The most pity that system work with this rule just as system take it - using "0", i.e. do nothing for all packets, because I haven't the nat 0.
But
ipfw add 400 fwd tablearg ip from table\(4\) to any
give expected result in system answer:
400 fwd tablearg ip from table(4) to any
and in reaction on matched packets.
I changed my rule to many rules:
ipfw add 300 nat 73 ip from table\(3,73\) to any
ipfw add 300 nat 225 ip from table\(3,225\) to any
and so on and this is working, but quantity of rules in the real system increased terribly.
Why may ipfw nat tablearg not work correctly ?