Bug 207553

Summary: A New variable of `firewall_nat_rules' in /etc/rc.conf
Product: Base System Reporter: Kazuhiko Kiriyama <kiri>
Component: miscAssignee: freebsd-rc (Nobody) <rc>
Status: New ---    
Severity: Affects Many People Keywords: patch
Priority: ---    
Version: CURRENT   
Hardware: Any   
OS: Any   
Description Flags
Patchs for `firewall_nat_rules' of /etc/rc.firewall and /etc/defaults/rc.conf none

Description Kazuhiko Kiriyama 2016-02-28 08:04:47 UTC
Created attachment 167503 [details]
Patchs for `firewall_nat_rules' of /etc/rc.firewall and /etc/defaults/rc.conf

Now ipfw(8) firewall nat is represented by firewall_nat_* variables in
/etc/rc.conf. All flags of nat rules were described by firewall_nat_flags

firewall_nat_flags="deny_in reset same_ports unreg_only redirect_port tcp 22253 redirect_port tcp 22252 "

But more redirections add, longer firewall_nat_flags line expand. To use
ipfw nat practically, redirection rules described in another file
like a `/etc/ipfw_nat.rules' and specify it's file name in rc.conf by
`firewall_nat_rules' variable. The new ipfw nat configuration is

1) Enable ipfw nat and specify nat global variables by firewall_nat_flags

firewall_nat_flags="deny_in reset same_ports unreg_only"

2) Then nat redirections specify in /etc/ipfw_nat.rules like

redirect_port   tcp      25
redirect_port   tcp      80
redirect_port   tcp      21
redirect_port   tcp 12345
redirect_port   tcp      66932
redirect_port   tcp      66053
redirect_port   tcp      66025
redirect_port   tcp      66080
redirect_port   tcp      66401
redirect_port   tcp  66419
redirect_port   tcp    66132

3) Set /etc/ipfw_nat.rules to firewall_nat_rules in /etc/rc.conf


To be able to this, /etc/rc.firewall changes as follows:

--- /etc/rc.firewall.org	2016-02-27 10:33:06.845684000 +0900
+++ /etc/rc.firewall	2016-02-28 16:02:08.404038000 +0900
@@ -162,6 +162,9 @@
 	case ${firewall_nat_enable} in
 		if [ -n "${firewall_nat_interface}" ]; then
+			if [ -n "${firewall_nat_rules}" -a -r ${firewall_nat_rules} ]; then
+				firewall_nat_flags="${firewall_nat_flags} `cat ${firewall_nat_rules}`"
+			fi
 			if echo "${firewall_nat_interface}" | \
 				grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; then
 				firewall_nat_flags="ip ${firewall_nat_interface} ${firewall_nat_flags}"