Solved Mistake in Handbook? (Configuring NAT)

J

johnd

In section 30.4.4 (Configuring NAT) there is a ruleset for inbound/outbound NAT. Below that, a scenario is drawn:

Code: 
#!/bin/sh
ipfw -q -f flush
cmd="ipfw -q add"
skip="skipto 500"
pif=dc0
ks="keep-state"
good_tcpo="22,25,37,53,80,443,110"

$cmd 005 allow all from any to any via xl0 # exclude LAN traffic
$cmd 010 allow all from any to any via lo0 # exclude loopback traffic
$cmd 100 divert natd ip from any to any in via $pif # NAT any inbound packets
# Allow the packet through if it has an existing entry in the dynamic rules table
$cmd 101 check-state

# Authorized outbound packets
$cmd 120 $skip udp from any to x.x.x.x 53 out via $pif $ks
$cmd 121 $skip udp from any to x.x.x.x 67 out via $pif $ks
$cmd 125 $skip tcp from any to any $good_tcpo out via $pif setup $ks
$cmd 130 $skip icmp from any to any out via $pif $ks

$cmd 499 deny log all from any to any
$cmd 500 divert natd ip from any to any out via $pif # skipto location for outbound stateful rules
$cmd 510 allow ip from any to any

Code: 
Consider an internal web browser which initializes a new outbound HTTP session over port 80. When the first outbound packet enters the firewall, it does not match rule 100 because it is headed out rather than in. It passes rule 101 because this is the first packet and it has not been posted to the dynamic state table yet. The packet finally matches rule 125 as it is outbound on an allowed port and has a source IP address from the internal LAN.

...

Isn't rule #005 the first rule that would match the packet in this scenario? And thus, rule processing would stop after #005 and no NAT actions would be performed?
 
Rule #005 matches only traffic that is either in or out on xl0. Traffic that is from the LAN but is destined for the internet gets forwarded by the kernel according the routing table and the NAT is applied to packets that are going out via dc0. Think of it as a two-part operation. The first is the packet arriving to the kernel from the LAN and the rule #005 applies to that, the second part is forwarding and sending it to the internet via dc0 and that's where the NAT rule #500 kicks in after the skip from a matching rule #120-#130.

The key to understanding why it works that way is that the same ruleset may get applied to the same traffic multiple times. Every interface has an inbound queue and outbound queue and when you have filter rules in place the rules are applied on both directions on all interfaces and matching rules are applied to the traffic.
 
You must log in or register to reply here.
Back
Top