binat-to address that's not assign to interface (4.9)

Article View: bit.listserv.openbsd-pf

Article #148

Back to bit.listserv.openbsd-pf Previous Next

#148

From: Brian Keefer
Date: Tue, 25 Jan 2011 20:07

6 lines
1571 bytes

I'm embarrassed to ask such a simple question.  Since 3.4 I've been running PF firewalls, but mostly for very small networks with 32 or fewer external addresses.  I always assigned my external IPs to my external interface and then did NAT or bi-NAT.

Now I'm building firewalls for much larger networks with /25 of external IPs.  They will all be either static or dynamic NAT, so proxy-ARP doesn't seem like the way to go.  Do I absolutely have to assign all these addresses to the external interface in order to use them for nat-to/binat-to, or can I simply have the upstream router set a route to one IP that I assign to the external interface (this is done already) and PF will be able to handle the translations?

--
bk

Technical Details

Message-ID: <0648AE9F-950F-4D8C-95D1-81D67A7AC0B6@smtps.net>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn

Show Full Headers

Complete Article Headers

X-Google-Thread: ff4ef,4a9095a84f0a9356,start
X-Google-NewGroupId: yes
X-Google-Attributes: gidbffa70e3,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: chort@smtps.net (Brian Keefer)
Newsgroups: bit.listserv.openbsd-pf
Subject: binat-to address that's not assign to interface (4.9)
Date: 25 Jan 2011 12:07:51 -0800
Organization: None
Lines: 10
Message-ID: <0648AE9F-950F-4D8C-95D1-81D67A7AC0B6@smtps.net>
NNTP-Posting-Host: [10.23.12.150]
Mime-Version: 1.0 (Apple Message framework v1082)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
NNTP-Posting-Date: 25 Jan 2011 20:07:52 GMT