Subject: ipnat rules / concept problem
To: None <ipfilter@coombs.anu.edu.au, current-users@NetBSD.ORG>
From: Patrick Welche <prlw1@cam.ac.uk>
List: current-users
Date: 06/12/1997 19:00:05
I am sure the following problem is soluble, but I don't see how:

Say there is an internal machine M, a router R, and a general
machine outside G. M has two ip addresses, an internal one Mi, and a
registered external one Me. The router has two interfaces, the
internal one, ed1, has ip number Ri, and the external one, ed0, has ip
number Re. Both Me and Re are on the same subnet (as indeed are Mi and
Ri).

M has Ri as its gateway, and R runs ipnat with
map ed0 Mi/32 -> Me/32
So, if M sends a packet to G, it goes to Ri which copies it to Re, and
then gets its src address mapped to Me.

G replies to Me, which gets onto the M/R subnet. For the packet to get
back, ed0 on R must also have Me as an alias, otherwise the packet
will just stay on the subnet. *Is this true?* The packet arrives on
ed0, so ipnat kicks in again, changes its dest to Mi and it gets back.

So far so good for a connection initiated from M. Now how about a
connection from G to M?

G sends a packet to Me. It arrives on ed0. R accepts it as an alias
for that interface and responds accordingly eg opens the telnet
connection with G instead of passing it on to M for it do the telnet.

There must be a rule which says something like
pass in to Me on ed0 to Mi on ed1 translating the address
but I can't work it out. Closest I can see is the dup-to
interface:ipnumber...

Any ideas would be much appreciated,

 Patrick