[FreeBSD] NAT

[Kulcsár Ferenc]

Szia,
> > Igaz-e az az allitasom, hogy a NAT egy szerenyebb tudasu IP filter, es
ha
> > filterezek, akkor tulajdonkeppen NAT-olok is egyben?
>
> semmi panik. az ipnat remek szimbiozisban el egyutt az ipfilterrel.
> az ipnat hasznalata mellett termeszetesen a tovabbiakban is szukseg van az
> ipf-re.
> mondd, hogy mi a kerdes, es segitunk :)

Roviden: ket halo kozott bidirekt, transzparens kapcsolat - nem bridge. Az
mar csak hab a tortan, hogy esetleg valamelyik ki is lasson az Internetre -
ami azzal jarhatna, hogy a transzparens NAT miatt a masik is kukkolhatna a
nagyvilagot - bar ahogy latom, a ketszeres NAT-olasra meg csak draft ajanlas
van.

Azt is mondhatnatok, hogy epitsek egy routert. Lehet, hogy az lesz a vege.
Jelenleg azonban a mukodo halo funkcionalitasanak teljes megtartasa mellett
kell kiserleteznem, ezert jonnek ilyen elvetemult otleteim.

Lehet, hogy lassan megvilagosodom? Ebed kozben is muveltem magam, es most
ugy tunik, hogy az ipnat mehet ipf nelkul, de forditva nem! Lasd az alabbi
idezetet a kicsit trukkos Darren Reed urtol:

Network Address Translation (NAT)

Network address translation is used to remap IP #'s from one address range
to another range of network addresses. For TCP
and UDP, this also can include the port numbers. The IP#'s/port #'s are
changed when a packet is going out through an
interface and IP Filter matches it against a NAT rules.

Packets coming back in the same interface are remapped, as a matter of
course, to their original address information.

# map all tcp connections from 10.1.0.0/16 to 240.1.0.1, changing the source
# port number to something between 10,000 and 20,000 inclusive.  For all
other
# IP packets, allocate an IP # between 240.1.0.0 and 240.1.0.255,
temporarily
# for each new user.  In this example, ed1 is the external interface.
# Use ipnat, not ipf to load these rules.
#
map ed1 10.1.0.0/16 -> 240.1.0.1/32 portmap tcp 10000:20000
map ed1 10.1.0.0/16 -> 240.1.0.0/24



Transparent Proxy Suppoer

Transparent proxies are supported through redirection, which works in a
similar way to NAT, except that rules are triggered
by input packets. To effect redirection rules, ipnat must be used (same as
for NAT) rather than ipf.

# Redirection is triggered for input packets.
# For example, to redirect FTP connections through this box (in this case
ed0
# is the interface on the "inside" where default routes point), to the local
# ftp port, forcing them to connect through a proxy, you would use:
#
rdr ed0 0.0.0.0/0 port ftp -> 127.0.0.1 port ftp

Na mit szoltok? ;-))

Feri