Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using ipfw nat with the following config

ipfw -q nat 1 config if em0

Which TCP and UDP ranges will the NAT choose its alias ports from? I would like it to be always from the range 49152–65535, so that I can do:

add allow tcp from any to me 22
add allow tcp from any to me 80
add deny tcp from any to me 1-49151
add nat 1 tcp from any to me recv em0 established

Does ipfw support this easily? If not, is there some way I can enforce this behaviour?

share|improve this question
    
I think you should read this first mate ncftp.com/ncftpd/doc/misc/ephemeral_ports.html –  Sergey Benner Jan 15 '12 at 23:34
    
@SergeyBenner Thanks, that really looks promising. Now I know which sysctl values to investigate. If you write the relevant parts up as an answer I might give you the bounty. –  Peter Smit Jan 16 '12 at 4:35

1 Answer 1

These settings for sysctl might help you.

net.inet.ip.portrange.first=32768
net.inet.ip.portrange.last=49151
net.inet.ip.portrange.hifirst=49152
net.inet.ip.portrange.hilast=65535

But I don't think it's easily achievable or to force the ipfw. There're src-port/dst-port options in the ipfw but I don't think they're suitable for your case and usually working for such things as redirect_port.... The internals of the natd(8) and divert(4) sockets do not have such parameters at least the ones I know of. The natd has -m parameter which means preserve ports and has the -out_port -o parameter but these are for the divert(4) socket and how to treat the outgoing packets within the ipfw's stack.

There're might be some netgraph based modules though which also might help you in the case. I haven't researched them though there's probably someone who has.

hope this will give you some insight

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.