0

I have a VLAN interface vlan0 that has a tag of 444 that has an IP of 172.16.16.16

The VLAN goes through the physical en0 interface.

I have another interface mine0 that's local just to the computer. The internal IP is assigned 192.168.168.168

I'm attempting to use binat rules to do a 1:1 NAT between vlan0 and mine0

My pf.conf:

binat on vlan0 from 172.16.16.16 to any -> 192.168.168.168

After setting up the pf rules I attempt to SSH using the 172.16.16.16 address.

My output from tcpdump host 10.10.10.10:

22:06:41.397177 IP 10.10.10.10.34755 > 172.16.16.16.ssh: Flags [S], seq 1984840961, win 26883, options [mss 1460,sackOK,TS val 4060403773 ecr 0,nop,wscale 7], length 0
22:06:41.397258 IP 192.168.168.168.ssh > 10.10.10.10.34755: Flags [S.], seq 2419525153, ack 1984840962, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 824423934 ecr 4060403773,sackOK,eol], length 0
22:06:42.400361 IP 192.168.168.168.ssh > 10.10.10.10.34755: Flags [S.], seq 2419525153, ack 1984840962, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 824424934 ecr 4060403773,sackOK,eol], length 0
22:06:42.425900 IP 10.10.10.10.34755 > 172.16.16.16.ssh: Flags [S], seq 1984840961, win 26883, options [mss 8861,sackOK,TS val 4060404802 ecr 0,nop,wscale 7], length 0
22:06:42.425994 IP 192.168.168.168.ssh > 10.10.10.10.34755: Flags [S.], seq 2419525153, ack 1984840962, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 824424958 ecr 4060404802,sackOK,eol], length 0
22:06:44.405921 IP 192.168.168.168.ssh > 10.10.10.10.34755: Flags [S.], seq 2419525153, ack 1984840962, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 824426935 ecr 4060404802,sackOK,eol], length 0
22:06:44.441985 IP 10.10.10.10.34755 > 172.16.16.16.ssh: Flags [S], seq 1984840961, win 26883, options [mss 8861,sackOK,TS val 4060406818 ecr 0,nop,wscale 7], length 0
22:06:44.442072 IP 192.168.168.168.ssh > 10.10.10.10.34755: Flags [S.], seq 2419525153, ack 1984840962, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 824426971 ecr 4060406818,sackOK,eol], length 0

Each of the SYN packets (Flags [S]) come in over the vlan0 interface.

However each of the SYN ACK packets (Flags [S.]) go over the en0 interface.

What do I need to change in order to have the packets going out use vlan0?

0

If there is a router or firewall between you and the other computer this:

SYN S Syn packet, is a session establishment request.

This request may not even get to its destination and even if it does you may not get a response. The state information may not be there if the security on one side is tighter than the other.

As sited: Cisco Web Services News:

Try this:

Set the variables to the interfaces you need them to be.

# Static 1:1 NAT for the internal WWW servers
binat on $ext_if from $www1_int to any -> $www1_ext
binat on $ext_if from $www2_int to any -> $www2_ext

Information found here: FreeBSD forum

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.