Bug 41807

Summary: [patch] natd(8): document natd -punch_fw "bug"
Product: Documentation Reporter: Jed Clear <clear>
Component: Books & ArticlesAssignee: Tom Rhodes <trhodes>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: Latest   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
natd.8.patch none

Description Jed Clear 2002-08-20 02:50:01 UTC 
The natd option -punch_fw won't work with kernel securelevel 3

This is really a feature of securelevel 3.

Fix: 

"Fix" is to add a note to the natd man page under the -punch_fw option
that securelevel 3 will disable punch_fw.

Long term:  If ipfw can add dynamic "keep-state" routes in securelevel 3,
why can't the NAT function?  Note I didn't say natd here.
How-To-Repeat: Setup working natd -punch_fw at securelevel 2 or lower on the firewall
Go to securelevel 3
Attempt active FTP from client inside to outside, fails.
Comment 1 Hiten Pandya 2002-09-27 17:10:37 UTC 
I am providing a delta, to add the "first" part of the "Fix".
Providing two line fixes is not always good, but it has come to my
attention that this PR has not been touched for a while, yet the
solution is simple; for whatever reasons ...

On that note, I do not know about the second part of the "Fix" (i.e.
about the keep-state stuff).  Maybe someone more knowledgeable in this
area of FreeBSD can comment on this.

Patch also available at:
http://www.unixdaemons.com/~hiten/work/diffs/natd.8.patch

-- 
Hiten Pandya
http://www.unixdaemons.com/~hiten
hiten@unixdaemons.com, hiten@uk.FreeBSD.org, hiten@xMach.org
PGP: http://pgp.mit.edu:11371/pks/lookup?search=Hiten+Pandya&op=index
Comment 2 dfilter service freebsd_committer freebsd_triage 2008-01-21 23:09:25 UTC 
trhodes     2008-01-21 23:09:18 UTC

  FreeBSD src repository

  Modified files:
    sbin/natd            natd.8 
  Log:
  Note that the punch_fw option does not work in securelevel 3 and Xref init.8.
  Bump .Dd.
  
  PR:             41807
  
  Revision  Changes    Path
  1.66      +6 -1      src/sbin/natd/natd.8
_______________________________________________
cvs-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/cvs-all
To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
Comment 3 Tom Rhodes freebsd_committer freebsd_triage 2008-01-21 23:09:27 UTC 
State Changed
From-To: open->patched

I have made a commit to the manual page.  In my opinion, this is not a bug, 
it's how securelevel works.  Thanks!
Comment 4 Tom Rhodes freebsd_committer freebsd_triage 2008-01-21 23:09:27 UTC 
Responsible Changed
From-To: freebsd-doc->trhodes

Assign to me, MFC reminder.
Comment 5 Gavin Atkinson freebsd_committer freebsd_triage 2008-05-29 11:52:00 UTC 
State Changed
From-To: patched->closed

Fixed in -HEAD, and was MFC'd to RELENG_7 and RELENG_6 Mar 4th 2008, 
so will appear in FreeBSD 6.4 and 7.1.