ipfilter with NAT question

bradvan · 10-29-2009, 10:15 AM

Need to set up ipfilter on Solaris 10. All the systems behind the Solaris system are using the 192.168.0.0/24 network and have a one-to-one routeable address assigned to it. So, I set up NAT using the bimap keyword, one for each pairing. My question is about when does the NATing occur? That is, in my block and pass rules, do I use the "NATed" address or the 192.168 address?

Thanks!

Never mind. I find the answer in the ipfilter FAQ:

http://www.phildev.net/ipf/IPFques.html#ques11

Thanks!

choogendyk · 10-29-2009, 09:03 PM

You could also look at /usr/share/ipfilter/examples on your Solaris 10 system. That's loaded with examples, including basic NAT. Just thought I would note that for future reference, and to make this not a 0 reply thread.

jlliagre · 10-29-2009, 10:27 PM

Interestingly, here is what I just found in one of these files:

Quote:

Originally Posted by /usr/share/ipfilter/examples/nat-setup

Filtering with NAT.
-------------------
IP Filter will always translate addresses in a packet _BEFORE_ it checks its
access list for inbound packets and translates addresses _AFTER_ it has
checked the access control lists for outbound packets.

bradvan · 10-30-2009, 05:09 AM

Thanks, I didn't know that was there. I'll take a look.

Thanks again!