FreeBSD IPFW NAT and Jails

IPFW in FreeBSD has built-in support for NATing and the configuration syntax is same as that of natd. It took me quite some time to figure out how to NAT for jails while ensuring that certain jails can have public IPs.

Configure the nat on one of the IP addresses:

When using stateful firewall, the NAT rule for incoming traffic must appear before check-state:

Other rules (service ports) can be placed below this:

Then the NAT rule for outgoing traffic:

Notice above, I am NATing only traffic that comes from 10.0.0.0/8 . I allocate jails an IP on that subnet (unless I need a public IP for the jail). If the source is not mentioned in the rule, it will NAT even public IPs!

And finally, the outgoing ports:

The catch here is that we jump to the NAT rule only if the traffic comes from 10.0.0.0/8 . If the traffic is coming from somewhere else (for example, a public IP allocated to one of the jails), it will hit the second rule and directly allow it.

Make sure you have the rule to allow loX traffic if you have separate clone interfaces for each jail.

Final touches:

The firewall script ipfw.rules must to contain other rules for services, icmp, etc not mentioned here.
Everything working smoothly now – ip4 from private jails, ip4 and ip6 from others 😀

Advertisements

4 thoughts on “FreeBSD IPFW NAT and Jails

Add yours

  1. Hi Nilesh,
    Thanks a bunch for posting your config script, I just have one question.
    When you use this config, do you have to set the sysctl net.inet.ip.fw.one_pass => 0 ?

    It seems to be the only way I can get it to forward traffic from my public IP to my 10.0.0.1 jail.

    I don’t fully understand the drawback of changing this sysctl default from 1 => 0

    Cheers

    1. I don’t remember making changes to that variable. So I was using the defaults.

  2. Hi,
    there is some useful information here about kernel NAT which is still hard to come by on the web. The FreeBSD Handbook doesn’t even mention using IPFW with kernel NAT.
    I would like to see a full IPFW ruleset with kernel NAT and dummynet enabled. I have been trying for days to get this working, without much success. Even if you don’t have dummynet enabled it would be useful to see your ipfw ruleset.
    Thank you.

Have something to add? Do it here.

Proudly powered by WordPress | Theme: Baskerville 2 by Anders Noren.

Up ↑

%d bloggers like this: