Current-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Hair pinning with pf and NetBSD

On Tuesday 24 November 2009 11:25:16 am Brian Buhrow wrote:
>         Hello.  Each box has an internal and external address.  
> So, for example, I have two boxes:
> and
> Each have external addresses:
> and
> (These are theoretical numbers)
> The customer wants to be on and talk to, but
> address it as

A possible way to do this is to ignore the NAT box.   I'm assuming
that all traffic from external goes through your NAT box and so
the configuration on and .4 just has the private IP

I'd add an alias on and .4 with their external
IP's of and .4.  Make their netmask small enough to
cover just your external IP address range.  Then, the machines
will directly talk to each other on the local net and will not have
to send any packets to the NAT box.  Both boxes will then be using
their "external IP addresses" on the internal network.  They can
also use their internal addresses to communicate.  But on your local
network you won't have a box using their internal IP to communicate with
another box using its external IP.  That is how you ignore the NAT box.

The result:  any host on the 157.22.25.x/y net looks local on the local
net and no packets are sent to the NAT box.  The NAT box sends external
traffic to 157.22.25.z to their 192.168.25.z address and the NAT box is
happy.  Hosts behind the NAT box still send their packets to the NAT box
if communicating to any other net other than the internal and the 
157.22.25.x net.  The default route of the hosts should still be the
internal address of the NAT box so that the hosts use their internal
addresses when sending packets to the NAT box for external routing.
The only possible problem is talking to the NAT box using an external IP,
but that may also be solvable.


Phil Nelson (phil at
NetBSD:  Coda:

Attachment: signature.asc
Description: This is a digitally signed message part.

Home | Main Index | Thread Index | Old Index