On Mon, 19 Jan 2004, fbsd_user wrote:
> That's a play on words. And still does not prove stateful rules work on
> the interface facing the public internet. There is no documentation that
> says keep-state and limit only works on the interface facing the private
> Lan network. And the implied meaning is they are to be used on the
> interface facing the public internet.
I just jumped in the middle here, so I may be out of context.
But, stateful rules don't play nice with NAT. Consider non-NAT, a public
IP address contacting an Internet address:
220.127.116.11 -> 18.104.22.168
A rule is created for 22.214.171.124 coming to 126.96.36.199. When
188.8.131.52 replies, the stateful rule lets it in. This is good.
But consider NAT:
10.0.0.10 changed to 184.108.40.206 -> 220.127.116.11
If you do a keep-state before NAT, you have a rule to allow 18.104.22.168
to 10.0.0.10, but the return incoming packet will be 22.214.171.124 ->
126.96.36.199, so the rule doesn't match.
If you do a keep-state after NAT, then you have a rule to allow
188.8.131.52 to 184.108.40.206. The return incoming packet matches that
rule, but it accepts the packet and packet processing stops, so it's never
passed through NAT, and never makes it back to 10.0.0.10.
So as it stands now, I don't see that you can use stateful connections
with NAT, unless check-state is changed to allow a packet to be passed