optimism 发表于 2021-7-15 20:40
这就要等个大佬了
Sometimes you may want to mix NAT and dynamic rules. It could be
achieved with record-state and defer-action options. Problem is, you
need to create dynamic rule before NAT and check it after NAT actions (or
vice versa) to have consistent addresses and ports. Rule with keep-state
option will trigger activation of existing dynamic state, and action of
such rule will be performed as soon as rule is matched. In case of NAT
and allow rule packet need to be passed to NAT, not allowed as soon is
possible.
There is example of set of rules to achieve this. Bear in mind that this
is example only and it is not very useful by itself.
On way out, after all checks place this rules:
ipfw add allow record-state skip-action
ipfw add nat 1
And on way in there should be something like this:
ipfw add nat 1
ipfw add check-state
Please note, that first rule on way out doesn't allow packet and doesn't
execute existing dynamic rules. All it does, create new dynamic rule
with allow action, if it is not created yet. Later, this dynamic rule is
used on way in by check-state rule.
LiuJia 发表于 2021-7-16 15:42
楼主您好，
是否可能是：
KDE 发表于 2021-7-16 21:16
ipfw nat 1 config redirect_port tcp 10.1.1.254:80 80
ipfw add nat 1 all from any to any
ipfw add a ...
LiuJia 发表于 2021-7-25 11:29
您好，
我在我本地的FreeBSD机试了一下，或许重点是需要设置skipto的规则。即用skipto来放行nat的的相应 ...
| 欢迎光临 全球主机交流论坛 (https://sunk.eu.org/) | Powered by Discuz! X3.4 |