Subject: ipnat: Multiple interfaces and routing
To: None <>
From: None <>
List: tech-net
Date: 11/27/2005 13:46:50
I'm having a problem getting ipnat to do NAT for two internal interfaces 
through one external. It looks to be a routing problem at this point, and 
I'm stumped. Here's the situation:

[]--ex0--[ipnat box]

I'm trying to NAT for both 192.168 networks. 192.168.1 works just fine, 
all traffic is routed correctly. However, anything on 192.168.2 appears to 
get routed into oblivion before any outbound Internet traffic can pass 
through the ipnat router. For example, pinging (mc0's IP) 
from a Solaris client will get a response from, instead of If I run tcpdump on ex0, and try to ping '' from (the Solaris client), I can see that the icmp echo messages 
appear to be leaving through ex0, but no data is ever returned.

Fortunately, routing within the LAN seems to be fine. The two LAN subnets 
can communicate with eachother just fine. I can telnet into 
from anywhere in 192.168.1, and vice versa. Still, nothing coming from 
192.168.2 ever gets NAT'ed properly.

The ipf/ipnat box is running 2.1/macppc. As far as ipf rules are 
concerned, I'm allowing any and all traffic on both LAN interfaces, so 
nothing should be getting blocked. Here is my ipnat.conf:

# Compensate for NAT-broken protocols
map ex0 -> 0/32 proxy port ftp ftp/tcp
map mc0 -> 0/32 proxy port ftp ftp/tcp

# Port redirections
#rdr ex0 port 6114 -> port 6114 udp

# Essential mappings
map ex0 ->
map ex0 -> portmap tcp/udp auto
map mc0 ->
map mc0 -> portmap tcp/udp auto

I'd like to note that I've tried different variations of the "map" 
command, none of which has made a difference so far.

Here's the routing table from the ipnat router:

Destination        Gateway            Flags     Refs     Use    Mtu 
default         UGS         2   417197      -  ex0
67.168.161/24      link#2             UC          1        0      -  ex0       00:0a:8b:6e:e0:55  UHLc        1        0      -  ex0          UGHS        0        0  33196  lo0
127/8              UGRS        0        0  33196  lo0          UH          3      284  33196  lo0
192.168.1/24       link#1             UC          3        0      -  tlp0       00:02:e3:21:c3:05  UHLc        1       12      -  tlp0      00:90:4b:46:81:50  UHLc        3   653034      -  tlp0      link#1             UHLc        2      193      -  tlp0
192.168.2/24       link#3             UC          2        0      -  mc0        00:05:02:38:98:61  UHLc        0        4      -  lo0        08:00:20:7c:1b:51  UHLc        1        1      -  mc0

And here is the routing table from the Solaris client that is having so 
many issues:

Routing Table: IPv4
   Destination           Gateway           Flags  Ref   Use   Interface
-------------------- -------------------- ----- ----- ------ ---------          U         1      2  le0            U         1      0  le0
default              UG        1      8              UH        1      0  lo0

Also, here's that interesting ping message from the Solaris box:

slowness:wysoft ~> ping -sn
PING ( 56 data bytes
64 bytes from icmp_seq=0. time=3. ms

Clients on 192.168.1 don't show this when pinging

Any help would be greatly appreciated. Let me know if there's more 
information that I could give.