• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

IPFW Iptables to IPFW

s25a

New Member


Messages: 4

#1
Hi all,

I am new to BSD coming from the Linux world (Debian and Ubuntu).
Most of the software and tools I used on debian I already tested on Freebsd and i9t's working quite well. I have one thing I used on a Debian server I did not find a solution yet.

On my old Debian I used a routing command with IPTABLES

Code:
iptables -t nat -A POSTROUTING -o igb0 -j MASQUERADE
On BSD i guess IPFW would be the right command but I am not really sure to be honest. Can someone help to translate this command?

Thanks a lot

S
 

linux->bsd

Active Member

Thanks: 35
Messages: 109

#4
If you're debating which of the three firewalls to use: coming from the world of iptables I settled on ipfw() because of its similarities (IMO), and I'm glad I did. However, because of ipfw()'s extensive feature set, its syntax can be a bit more challenging than the others when writing really complex or advanced rules. The simple allow|deny rules are straightforward, though.
 

s25a

New Member


Messages: 4

#5
Hi all,

thanks a lot for all the information :)

Code:
If you're debating which of the three firewalls to use: coming from the world of iptables I settled on ipfw()
That would be also my plan. As I am completely new in BSD and also in those kind of Networking / Firewall configurations I am a bit struggling with the manual.
I assume that the NATD() Daemon would be the right one. I understood how to enable this in the rc.conf and to define the interface

Code:
gateway_enable="YES"        # enables the gateway
natd_enable="YES"        # enables NAT
natd_interface="igb0"   # Interface on my system that is connected to the internet
However now I am a bit lost to define the right rules to enable the routing form igb0 to all the other Interfaces. Any advice on how to start?

Thanks S
 

ondra_knezour

Aspiring Daemon

Thanks: 181
Messages: 738

#6
We have documentation for this of course :)

The concept is really straight forward. More is described in the Handbook linked above, but quick intro is:

I am computer, I have packet to send, what I will do?
- Is it for local network address (mask is used here, that /24 or 255.255.255.0 for example). If it is, get MAC for this address and send directly.
- If not, is it for network I know route to? If it is, send it to gateway for given network. Routing tables are used here, you can see them by netstat -r command. End user computer usually has only few entries related to local network(s).
- If both previous answers was negative, send it to default gateway.

And what about receiving? If packet is for me, process it, else drop it. And here start magic. If you enable gateway (which turns forwarding sysctl on on boot, see link above), it can be said in really simplified way, that such machine treats others computers packets as its own and apply procedure described above on them instead of dropping them.

However, it is not enough if you have address not routable on internet (private addresses like 192.168.x.x etc., see RFC 1918). With such address, computer at destination would not be able to reply to you (besides fact that all routers on route should drop it on its way there already). So here magic part two start. With NAT enabled, router change source address in the packet header to its own (and keep information about it to reverse it for returning packets), because it is for sure, that device which will get this packet know route back. This may be done several times, consider following example

Home computer address 192.168.0.2/24 <------------> Home router internal interface 192.168.0.1/24|Home router external interface 10.0.0.2/24 <------------------------> Internet provider interface facing customer 10.0.0.1/24|Providers network|Providers interface facing internet with "public" address 8.8.8.8

In the example above, all addresses, excluding last, are not internet routable. Only last one is (Google DNS used as example here), so there would be at least two address translations, at home router and somewhere in the ISP network.
 
Top