From owner-FreeBSD-net-jp@jp.freebsd.org  Sun Jul 22 02:07:29 2001
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id CAA04069;
	Sun, 22 Jul 2001 02:07:29 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from mail.netwave.or.jp (mail.netwave.or.jp [202.214.48.114])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id CAA04064
	for <FreeBSD-net-jp@jp.freebsd.org>; Sun, 22 Jul 2001 02:07:27 +0900 (JST)
	(envelope-from kana@mail.netwave.or.jp)
Received: from fukp400.mail.netwave.or.jp (ppp229145.netwave.or.jp [210.142.229.145])
	by mail.netwave.or.jp (8.9.3+3.2W/3.7W) with ESMTP id CAA09989
	for <FreeBSD-net-jp@jp.freebsd.org>; Sun, 22 Jul 2001 02:07:21 +0900 (JST)
Message-Id: <4.3.2-J.20010722020404.00b61ee0@mail.netwave.or.jp>
X-Sender: kana/mail.netwave.or.jp@pop3.norton.antivirus
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2-J
Date: Sun, 22 Jul 2001 02:06:52 +0900
To: FreeBSD-net-jp@jp.freebsd.org
From: Kana Akira <kana@mail.netwave.or.jp>
In-Reply-To: <ybsd76xadee.wl@ett.sat.t.u-tokyo.ac.jp>
References: <4.3.2-J.20010719010158.00c55b40@mail.netwave.or.jp>
 <4.3.2-J.20010719010158.00c55b40@mail.netwave.or.jp>
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-2022-JP"
Content-Transfer-Encoding: 7bit
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+010328
X-Sequence: FreeBSD-net-jp 3238
Subject: [FreeBSD-net-jp 3238] Re: IPFW+NATD
 =?ISO-2022-JP?B?GyRCJEdGYkl0JEsbKEI=?= Firewall
 =?ISO-2022-JP?B?GyRCJHI5PUNbGyhC?= 
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org
X-Originator: kana@mail.netwave.or.jp

$B2CL>(B $B$G$9!#!!5.=E$J$40U8+$"$j$,$H$&$4$6$$$^$9!#=u$+$j$^$9!#(B

>1. natd $B$r;H$&I,A3@-$,$h$/$o$+$j$^$;$s(B.
>	$B$3$N$^$^$N9=@.$G$b(B nat $B$7$J$$$[$&$,$o$+$j$d$9$/$J$$$G$9$+(B?
>	$B$*$=$i$/(B mail server $B$,(B 192.168.1.* $B$K$J$$$H(B, Windows $B4X78(B
>	$B$N(B routing $B$N@_Dj$,LLE]$K$J$k$;$$$+$H;W$$$^$9$,(B.

$B;d$b(Bnatd$B$OITMW$G$O$J$$$+$H;W$$$^$7$?!#$V$i2<$,$k$N$O8GDj%"%I%l%9$N(B
$B%5!<%P#1Bf$@$1$@$7!"B>$K%5!<%P$,A}$($F$b%"%I%l%9$O8GDj$K$9$k$@$m$&$7(B
$BJ#;($K$J$k$@$1$G7y$@$C$?$s$G$9$,(BREDIRECT_PORT$B$r;H$o$J$1$l$P$J$i$J$$$@$1(B
$B$G(Bnatd$B$rA*Br$7$^$7$?!#$4;XE&$N$H$*$j(BWindows$B7O$N(Brouting$B$b9M$($J$/$F$$$$(B
$B$N$G!&!&!&%m!<%+%k%k!<%?$C$F(Brouting$B5!G=$O$[$s$N$*$^$1$+$b$7$l$J$$$7!#(B

>	$B%m!<%+%k%k!<%?$N(B routing $B$N@_Dj$rE,@Z$K$9$l$P(B, icmp redirect

$B$3$l$b%A%i%C$HF,$KIb$+$s$@$N$G$9$,!"%m!<%+%k%k!<%?$,%$%s%?!<%M%C%HB&(B
$B$+$i$N%"%/%;%9!JNc$($P(Bport:80$B!K$r(BForwarding$B$G$-$k@h$N%5!<%P$O(B
192.168.1.0$B>e$N%5!<%P$@$1$J$s$G$9!#$G$9$N$G!"0lCJ2<$N(B192.168.5.10$B$N(B
$B%5!<%P$N(Bport:80$B$K$OD>@\Aw$l$^$;$s!#$3$N!V(Bicmp redirect$B!W$H$$$&$N$O(B
$B%m!<%+%k%k!<%?$K(B192.168.5.0$B$X$N(Bstatic route$B$r@_Dj$9$k!"$H$$$&0UL#$G$9(B
$B$M!)!!;d$NJY6/ITB-$J$s$G$9$,!"(BIPFW+NATD$B$N%5!<%P$N(Bport:80$B$K?6$C$?$b$N$r(B
redirect$B$7$F(B192.168.5.10$B$KEO$;$k5!G=$r;H$(!"$H$$$&0UL#$G$O$J$$$G$9$M!)(B
$B$H$J$k$H!"$d$O$j$3$N9=@.$G$O(Bnatd$B$G(BREDIRECT_PORT$B$r;H$&$7$+$J$$$H$$$&$3$H(B
$B$K$J$k$N$G$7$g$&$+!&!&!&(B

>2. $BIaDL$N9=@.$@$H(B,
>            IPFW
>              |
>   +----------+-------------+
>   |$B!!!!(B                    |
>  windows                 windows
>
>   $B$H$+$J$k$H;W$&$N$G$9$,(B, $B4:$F$3$N$h$&$J9=@.$K$7$J$$$N$O(B,
>   IPFW $B$,F0$$$F$$$k(B machine $B$,$J$s$i$+$NM}M3$G$3$1$?$H$-$K(B
>   $B30$K=P$i$l$J$/$J$C$F$7$^$&$+$i$G$7$g$&$+(B?

$B$=$l$b$"$j$^$7$?!#H"$+$i=P$7$?%m!<%+%k%k!<%?$r(BCATV$B%M%C%H$K@\B3$9$k$@$1(B
$B$G$9$0%$%s%?!<%M%C%H$K%"%/%;%9$G$-!"$^$?(Bip$B%^%9%+%l!<%I$J$N$G30It$+$i(B
$B3F<+$N%Q%=%3%s$d(BWindows$B6&M-%U%)%k%@$rIT@5%"%/%;%9$5$l$k62$l$b$J$$$7!"(B
$B%1!<%V%k%b%G%`B&$G$bI8=`$G(BNetbios$B7O$N%Q%1%C%H$J$I$OMn$H$7$F$/$l$F$$$k(B
$B$i$7$/!"G0$N$?$a%m!<%+%k%k!<%?$N4J0W(Bfilter$B$G$b(BUDP:137-139$BEy$,30$K=P$F$$(B
$B$+$J$$$h$&$K$b@_Dj$7$^$7$?!#$3$l$C$F<j7Z$G0U30$H$7$C$+$j$7$?(BFirewall$B$H(B
$B9M$($i$l$^$;$s$+!)!!(BIPFW$B$N2<$K(BDHCP$B$d(BNAT$B$G3F<+$N%Q%=%3%s$r@\B3$9$k$H(B
UDP$B$N2?HV$+$i2?HV$^$G$r3+$1$F$d$i$J$$$H(Bchat$B7O$J$I$N%=%U%H$,;H$($J$$$H$+!"(B
$B8e$G$"$l$3$l(Brule$B$rJQ99$7$J$1$l$P$$$1$J$$$h$&$J5$$,$7$F!"5U$K@_Dj%_%9$K(B
$B$h$j7j$,6u$/?4G[$N$[$&$,5$$K$J$j$^$9!#!J;d$,L$=O$J$@$1$G$9$,!&!&!K(B

$B$=$l$h$j$b5U$K!";H$&(Bport$B$,$[$\8GDj$5$l$F$$$k(Bmail$B!"(BWWW$B!"(BDNS$B!"(Bpop$B$J$I$N(B
$B%5!<%P$r(BIPFW$B%5!<%P$N2<$KCV$$$F$7$C$+$j$7$?8GDj$N(Brule$B$rAH$s$G$d$k$[$&$,(B
$B8e$N(Brule$BJQ99$b$"$^$jL5$$$h$&$K;W$$$^$9$7!"$H$F$b$$$$9M$($N$h$&$J5$$,(B
$B$7$?$s$G$9$,!"$I$&$G$7$g$&$+!)!!!!;d<+?H!"$"$^$j8+$+$1$J$$9=@.$@$H$O(B
$B46$8$F$$$k$s$G$9$,!"8+$+$1$J$$$N$O$d$O$j$J$K$+LdBj$,$"$k$N$+$J!&!&!&(B
$B%5!<%P7O$9$Y$F%@%&%s$7$F$b860xD4::$d%Q%C%A<hF@$N$?$a%Q%=%3%s$+$i(BWWW$B$d(B
ftp$B$,2DG=$H$$$&$N$b0B?4$G$9$7!&!&!&(B

>> add allow log icmp from any        to any   in via vr0 icmptypes 3

>$B>l9g$K$h$C$F$O(B, ICMP_UNREACH_NEEDFRAG $B$"$?$j$ODL$7$F$"$2$J$$$H(B,
>$BDL?.$G$-$J$/$J$k$3$H$,$"$j$^$9(B.

$BJY6/ITB-$G?=$7Lu$"$j$^$;$s!#$3$l$C$F!V(BPath MTU Discovery $B!W$H$+$$$&$b$N(B
$B$K4X78$9$k(BICMP$B$G$7$g$&$+!)!!>e5-(Brule$B$G(B in $B$N(Bicmptypes 3 $B$@$15v$7$F$$$^$9(B
$B$,(B out $B$9$kJ,$b5v$5$J$$$H$$$1$J$$!"$H;d$O2r<a$7$?$N$G$9$,!"$=$&$$$&$3$H(B
$B$G$$$$$G$9$+!)!!$H$9$k$H(Bicmptypes 3 $B$O$$$D$bL5>r7o$GAPJ}8~DL$7$F$7$^$C$F(B
$B$b$$$$$s$G$7$g$&$+!)!!(Bicmp$B$N$3$H$O!&!&!&;d$"$^$jJY6/$G$-$F$$$^$;$s!#(B

