What port range will ipfw nat use for aliasing?

Question

I am using ipfw nat with the following config

ipfw -q nat 1 config if em0

Which TCP and UDP ranges will the NAT choose its alias ports from? I would like it to be always from the range 49152–65535, so that I can do:

add allow tcp from any to me 22
add allow tcp from any to me 80
add deny tcp from any to me 1-49151
add nat 1 tcp from any to me recv em0 established

Does ipfw support this easily? If not, is there some way I can enforce this behaviour?

Answer 1

These settings for sysctl might help you.

net.inet.ip.portrange.first=32768
net.inet.ip.portrange.last=49151
net.inet.ip.portrange.hifirst=49152
net.inet.ip.portrange.hilast=65535

But I don't think it's easily achievable or to force the ipfw. There're src-port/dst-port options in the ipfw but I don't think they're suitable for your case and usually working for such things as redirect_port.... The internals of the natd(8) and divert(4) sockets do not have such parameters at least the ones I know of. The natd has -m parameter which means preserve ports and has the -out_port -o parameter but these are for the divert(4) socket and how to treat the outgoing packets within the ipfw's stack.

There're might be some netgraph based modules though which also might help you in the case. I haven't researched them though there's probably someone who has.

hope this will give you some insight