Bug 207553 - A New variable of `firewall_nat_rules' in /etc/rc.conf
Summary: A New variable of `firewall_nat_rules' in /etc/rc.conf
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: misc (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Many People
Assignee: freebsd-rc (Nobody)
Keywords: patch
Depends on:
Reported: 2016-02-28 08:04 UTC by Kazuhiko Kiriyama
Modified: 2018-05-31 15:30 UTC (History)
0 users

See Also:

Patchs for `firewall_nat_rules' of /etc/rc.firewall and /etc/defaults/rc.conf (1.14 KB, patch)
2016-02-28 08:04 UTC, Kazuhiko Kiriyama
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Kazuhiko Kiriyama 2016-02-28 08:04:47 UTC
Created attachment 167503 [details]
Patchs for `firewall_nat_rules' of /etc/rc.firewall and /etc/defaults/rc.conf

Now ipfw(8) firewall nat is represented by firewall_nat_* variables in
/etc/rc.conf. All flags of nat rules were described by firewall_nat_flags

firewall_nat_flags="deny_in reset same_ports unreg_only redirect_port tcp 22253 redirect_port tcp 22252 "

But more redirections add, longer firewall_nat_flags line expand. To use
ipfw nat practically, redirection rules described in another file
like a `/etc/ipfw_nat.rules' and specify it's file name in rc.conf by
`firewall_nat_rules' variable. The new ipfw nat configuration is

1) Enable ipfw nat and specify nat global variables by firewall_nat_flags

firewall_nat_flags="deny_in reset same_ports unreg_only"

2) Then nat redirections specify in /etc/ipfw_nat.rules like

redirect_port   tcp      25
redirect_port   tcp      80
redirect_port   tcp      21
redirect_port   tcp 12345
redirect_port   tcp      66932
redirect_port   tcp      66053
redirect_port   tcp      66025
redirect_port   tcp      66080
redirect_port   tcp      66401
redirect_port   tcp  66419
redirect_port   tcp    66132

3) Set /etc/ipfw_nat.rules to firewall_nat_rules in /etc/rc.conf


To be able to this, /etc/rc.firewall changes as follows:

--- /etc/rc.firewall.org	2016-02-27 10:33:06.845684000 +0900
+++ /etc/rc.firewall	2016-02-28 16:02:08.404038000 +0900
@@ -162,6 +162,9 @@
 	case ${firewall_nat_enable} in
 		if [ -n "${firewall_nat_interface}" ]; then
+			if [ -n "${firewall_nat_rules}" -a -r ${firewall_nat_rules} ]; then
+				firewall_nat_flags="${firewall_nat_flags} `cat ${firewall_nat_rules}`"
+			fi
 			if echo "${firewall_nat_interface}" | \
 				grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; then
 				firewall_nat_flags="ip ${firewall_nat_interface} ${firewall_nat_flags}"