From owner-FreeBSD-net-jp@jp.freebsd.org  Thu Jul 19 10:58:03 2001
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id KAA10598;
	Thu, 19 Jul 2001 10:58:03 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from sylph.sat.t.u-tokyo.ac.jp (nat.keisu.t.u-tokyo.ac.jp [133.11.68.2])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id KAA10591
	for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 19 Jul 2001 10:58:02 +0900 (JST)
	(envelope-from simokawa@sat.t.u-tokyo.ac.jp)
Received: from ett.sat.t.u-tokyo.ac.jp (ett.sat.t.u-tokyo.ac.jp [10.6.1.30])
	by sylph.sat.t.u-tokyo.ac.jp (Postfix) with ESMTP id B64BD2DABC
	for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 19 Jul 2001 10:58:01 +0900 (JST)
Date: Thu, 19 Jul 2001 10:58:01 +0900
Message-ID: <ybsd76xadee.wl@ett.sat.t.u-tokyo.ac.jp>
From: Hidetoshi Shimokawa <simokawa@sat.t.u-tokyo.ac.jp>
To: FreeBSD-net-jp@jp.freebsd.org
In-Reply-To: <4.3.2-J.20010719010158.00c55b40@mail.netwave.or.jp>
References: <4.3.2-J.20010719010158.00c55b40@mail.netwave.or.jp>
User-Agent: Wanderlust/2.4.1 (Stand By Me) REMI/1.14.3 (Matsudai) FLIM/1.13.2 (Kasanui) APEL/10.3 MULE XEmacs/21.2 (beta19) (Shinjuku) (i386-unknown-freebsd3.2)
X-Face: OE([KxWyJI0r[R~S/>7ia}SJ)i%a,$-9%7{*yihQk|]gl}2p#"oXmX/fT}Bn7:#j7i14gu$
 jgR\S*&C3R/pJX<mI-4Z8'mqt1R'CjWdw-xqVoilv`\JgZcquM5oVuO^<vt/~051rCDM(`{rM~?{Ok
 r,XC+}Ycm9IJO)odT*-0nyJjBJYzL{GsZ
MIME-Version: 1.0 (generated by REMI 1.14.3 - "Matsudai")
Content-Type: text/plain; charset=ISO-2022-JP
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+010328
X-Sequence: FreeBSD-net-jp 3234
Subject: [FreeBSD-net-jp 3234] Re: IPFW+NATD
 =?ISO-2022-JP?B?GyRCJEdGYkl0JEsbKEI=?= Firewall
 =?ISO-2022-JP?B?GyRCJHI5PUNbGyhC?= 
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org
X-Originator: simokawa@sat.t.u-tokyo.ac.jp

$B$"$^$j:Y$+$/8!F$$7$?$o$1$G$O$J$$$G$9$,(B...

At Thu, 19 Jul 2001 01:18:23 +0900,
Kana Akira wrote:
>
> $B$O$8$a$^$7$F!#!!2CL>(B $B$H?=$7$^$9!#(B
> IPFW$B!\(BNATD$B$G%"%I%P%$%9D:$-$?$$$N$G$9$,!&!&!&(B
>
> $B2q<R$N(BLAN$B$r(BCATV$B$N%M%C%H%o!<%/$K@\B3$9$k$3$H$K$J$j!"(B
> MAIL$B%5!<%P!J7s(BDNS+WWW+POP3$B!K$r(BFreeBSD$B$G9=C[$9$k$3$H$K$J$j$^$7$?!#(B
> $B@\B3?^$O0J2<$G$9$,!"%m!<%+%k%k!<%?$N(BIP$B%^%9%+%l!<%I5!G=$r;H$C$F(B
> Win9x$B7O$N%Q%=%3%s$O%$%s%?!<%M%C%H$K=P$F9T$1$k$h$&$K$9$kM=Dj$G$9!#(B
>
>               CATV$B%M%C%H%o!<%/(B
>                 |
>                 |  211.XXX.YYY.ZZZ$B!J%0%m!<%P%k%"%I%l%9!K(B
>             +---+---+
>             |       |  $B%V%m!<%I%P%s%I%k!<%?!J"(%m!<%+%k%k!<%?!K(B
>             +---+---+
>                 |  192.168.1.1
>                 |
>         +-------+------------------------+-------- $B!A(B -------+
>         |192.168.1.20                    |192.168.1.100      |
>     +---+---+                        +---+---+           +---+---+
>     |FreeBSD| IPFW+NATD              |Win9x  |     $B!A(B    |Win2000|
>     +---+---+                        +-------+           +-------+
>         |192.168.5.1              $B"((B Win9x $B$d(B Win2000 $B$O(B DHCP$B$G(B
>         |$B!!!!!!!!!!!!!!!!!!!!!!!!!!!!(B192.168.1.100->192.168.1.150
>         |192.168.5.10$B!!!!!!!!!!!!!!!!$NHO0O$G%"%I%l%9$,3d$jEv$F$i$l$k(B
>     +---+---+
>     |FreeBSD| MAIL$B%5!<%P!J7s(BDNS+WWW+POP3$B!K(B
>     +-------+

1. natd $B$r;H$&I,A3@-$,$h$/$o$+$j$^$;$s(B.
	$B$3$N$^$^$N9=@.$G$b(B nat $B$7$J$$$[$&$,$o$+$j$d$9$/$J$$$G$9$+(B?
	$B$*$=$i$/(B mail server $B$,(B 192.168.1.* $B$K$J$$$H(B, Windows $B4X78(B
	$B$N(B routing $B$N@_Dj$,LLE]$K$J$k$;$$$+$H;W$$$^$9$,(B.
	$B%m!<%+%k%k!<%?$N(B routing $B$N@_Dj$rE,@Z$K$9$l$P(B, icmp redirect
	$B$G$J$s$H$+$J$i$J$$$G$7$g$&$+(B.

2. $BIaDL$N9=@.$@$H(B,

         local router
              |
              |
	      + - Mail server
	      |
              |
            IPFW
              |
   +----------+-------------+
   |			    |
  windows              	   windows

   $B$H$+$J$k$H;W$&$N$G$9$,(B, $B4:$F$3$N$h$&$J9=@.$K$7$J$$$N$O(B,
   IPFW $B$,F0$$$F$$$k(B machine $B$,$J$s$i$+$NM}M3$G$3$1$?$H$-$K(B
   $B30$K=P$i$l$J$/$J$C$F$7$^$&$+$i$G$7$g$&$+(B?

> # $BFbIt$+$i30It$X$N(B ping $B$H$=$N1~Ez$N$_$r5v2D(B
> add allow log icmp from any             to any      via ed1
> add allow log icmp from any             to any  out via vr0 icmptypes 8
> add allow log icmp from any             to any   in via vr0 icmptypes 0
> add allow log icmp from any             to any   in via vr0 icmptypes 3
> 
> # $B>e5-0J30$N(B ICMP $B$OGK4~(B
> add deny  log icmp from any             to any

$B>l9g$K$h$C$F$O(B, ICMP_UNREACH_NEEDFRAG $B$"$?$j$ODL$7$F$"$2$J$$$H(B,
$BDL?.$G$-$J$/$J$k$3$H$,$"$j$^$9(B.

/\ Hidetoshi Shimokawa
\/  simokawa@sat.t.u-tokyo.ac.jp
PGP public key: http://www.sat.t.u-tokyo.ac.jp/~simokawa/pgp.html

