0

I'm trying to set up simple natd port forwarding on my FreeBSD router, so that I can get to local Win machine (192.168.20.10) via RDP from external network.

The configuration is following: FreeBSD 12.0 machine with 2 NICs igb0 and igb1. PPPoE internet connection on igb0. ISP gives me fixed public IP via DHCP, bringing up tun0 interface, looking like this:

tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1492
   options=80000<LINKSTATE>
   inet 91.122.x.x --> 91.122.y.y netmask 0xffffffff
   groups: tun
   nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
   Opened by PID 1149

(where 91.122.x.x is my fixed public IP address)

LAN on igb1, internet access works on local machines.

Kernel is rebuilt with the following options:

#IPFW
 options         IPFIREWALL
 options         IPFIREWALL_VERBOSE
 options         IPFIREWALL_VERBOSE_LIMIT=30
 options         LIBALIAS
 options         IPFIREWALL_DEFAULT_TO_ACCEPT   # optional, won't let you lock out
 options         IPDIVERT

#PPPoE
 options         NETGRAPH
 option          NETGRAPH_PPPOE
 options         NETGRAPH_SOCKET

Configuration is the following:

root@beastiebox:/etc # cat rc.conf
hostname="beastiebox"
gateway_enable="YES"
ifconfig_igb0="DHCP"
ifconfig_igb1="inet 192.168.20.1 netmask 255.255.255.0"
mpd_flags="-b"
mpd_enable="YES"
sshd_enable="YES"
#NAT
natd_enable="YES"
natd_interface="igb0"
natd_flags="-f /etc/natd.conf"
#DHCP
dhcpd_enable="YES"
dhcpd_flag="-q"
dhcpd_conf="/usr/local/etc/dhcpd.conf"
dhcpd_ifaces="igb1"
dhcpd_withumask="022"
dhcpd_chuser_enable="YES"
dhcpd_withuser="dhcpd"
dhcpd_withgroup="dhcpd"
dhcpd_chroot_enable="YES"
dhcpd_devfs_enable="YES"
dhcpd_rootdir="/var/db/dhcpd"
#Firewall
firewall_enable="YES"
firewall_type="simple"
firewall_script="/etc/ipfw.rules"
firewall_logging="YES"
firewall_script="YES"
root@beastiebox:/etc # cat natd.conf
same_ports yes
use_sockets yes
#unregistered_only yes
redirect_port tcp 192.168.20.10:3389 3389
redirect_port udp 192.168.20.10:3389 3389

Firewall is transparent so far:

root@beastiebox:/etc # ipfw list
65535 allow ip from any to any
root@beastiebox:/etc #

I've already tried a lot of options, but still can not RDP to the local Win machine from outside. (It works if I swap my FreeBSD router with another one I used before). I just don't understand what is blocking natd redirect_port rules when ipfw is configured to allow ip from any to any.

Please help me point out errors in my config.

Please do not suggest different ways (pf, etc) of port forwarding configuration, I'm specifically asking about natd/ipfw.

  • You are missing any divert rule in your IPFW configuration. See the handbook for details. – Richard Smith Oct 4 '19 at 11:45
  • Do I need divert rule even if the firewall is transparent? And even if I set firewall_type="OPEN" or firewall_enable="NO" or just comment out all #Firewall section of my rc.conf? (I tried these options already). And if I set up divert ipfw rule why do I actually need natd redirect_port rules? – guahos Oct 4 '19 at 12:03
  • I mean, if I have to set up ipfw rules for port forwarding, can I do port forwarding with ipfw rules only, w/o natd at all? And can I set up port forwarding with natd only, w/o ipfw? I just do not understand what is blocking natd redirect_port rules if ipfw if configured to allow from any to any. – guahos Oct 4 '19 at 12:21
  • The handbook states that natd works in conjunction with ipfw. Take a look at /etc/rc.firewall for the example rules, but OPEN should create the divert rules. Check using ipfw list – Richard Smith Oct 4 '19 at 13:05
0

I figured out the issue finally.

I tried to kill natd just to restart it with some test options and I was totally stunned by the fact that LAN machines did not lose their internet connection after that. I started investigating and discovered that I had another separate NAT working! That was ppp nat setup in /etc/ppp/ppp.conf. So, that was the root cause. However I had to change some of my natd/ipfw settings in order for everything to work as intended.

First off, I changed natd_interface="igb0" to natd_interface="tun0" (from my external NIC to the interface pppoe bringing up on connect). And I added the ipfw divert rule, looking like that:

ipfw add divert natd from any to any via tun0

Everything works fine after that and I'm proceeding with my firewall tuning now.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.