IPFW vlan35 client can't get into the internet, but can reach to the pppoe server

[kriptomahsun]

I am trying to do this with ipfw instead of pf because of it's faster. This is the script for firewall, I run it and client can reach the freebsd pppoe server just fine. But not to the internet.

root@user-freebsd:/home/user # cat firewall.sh

#!/bin/sh

# Flush tüm kurallar ve NAT objelerini temizle

ipfw -q -f flush


# Kernel NAT oluştur

ipfw nat 1 config if re0 same_ports reset

ipfw add 100 nat 1 ip from 192.168.0.0/24 to any out via re0 #re0 where the internet reaches to this PC


ipfw add 200 allow ip from any to any via vlan35#this is the re1 actually, which gives via vlan35

ipfw add 210 allow ip from any to 192.168.0.1


ipfw add 65000 allow ip from any to any via lo0

ipfw add 65500 allow ip from any to any

Also on /etc/rc.conf I added this:

gateway_enable="YES"
pf_enable="NO"
ifconfig_ng0="DHCP"
firewall_enable="YES"
firewall_type="open" #I run the above script later to change it.
ifconfig_re0="DHCP"

In pf I used to this, and it worked very well. But it's too slow, I need something faster with ipfw with kernel:

ext_if = "re0"
int_if = "ng0"

set skip on lo

# NAT kuralı (tüm internal ağ için)
nat on re0 from 192.168.0.0/24 to any -> (re0)
# İç ağdan dışa trafik izinli
pass in all
pass out all keep state

 

[SirDice]

vlan35#this is the re1 actually, which gives via vlan35

This is confusing, there's no re1 or vlan35 interface defined in your rc.conf. Interfaces that exist but are not configured are administratively 'down', in other words inactive. They do not accept or transmit any kind of traffic.

 

[covacat]

also you have to have incoming external traffic go thru the nat rule to for de-aliasing

 

[sko]

In pf I used to this, and it worked very well. But it's too slow,

I highly doubt that PF is slow...

 

[kriptomahsun]

vlan35#this is the re1 actually, which gives via vlan35

This is confusing, there's no re1 or vlan35 interface defined in your rc.conf. Interfaces that exist but are not configured are administratively 'down', in other words inactive. They do not accept or transmit any kind of traffic.

Sorry I forgot. I later do that with a script, that was on my work PC. Something like this:
ifconfig vlan35 create
ifconfig vlan35 vlan 35 vlandev re1

 

[kriptomahsun]

vlan35#this is the re1 actually, which gives via vlan35

This is confusing, there's no re1 or vlan35 interface defined in your rc.conf. Interfaces that exist but are not configured are administratively 'down', in other words inactive. They do not accept or transmit any kind of traffic.

For now I kinda fixed(barely) by doing firewall_type=open or something like this. I didn't change anything then.

 

[kriptomahsun]

edit: delete this duplicate comment