On Mon, 19 Jan 2004, fbsd_user wrote:
> That's a play on words. And still does not prove stateful rules work on
> the interface facing the public internet. There is no documentation that
> says keep-state and limit only works on the interface facing the private
> Lan network. And the implied meaning is they are to be used on the
> interface facing the public internet.
I just jumped in the middle here, so I may be out of context.
But, stateful rules don't play nice with NAT. Consider non-NAT, a public
IP address contacting an Internet address:
67.161.59.61 -> 66.218.71.91
A rule is created for 66.218.71.91 coming to 67.161.59.61. When
66.218.71.91 replies, the stateful rule lets it in. This is good.
But consider NAT:
10.0.0.10 changed to 67.161.59.61 -> 66.218.71.91
If you do a keep-state before NAT, you have a rule to allow 66.218.71.91
to 10.0.0.10, but the return incoming packet will be 66.218.71.91 ->
67.161.59.61, so the rule doesn't match.
If you do a keep-state after NAT, then you have a rule to allow
66.218.71.91 to 67.161.59.61. The return incoming packet matches that
rule, but it accepts the packet and packet processing stops, so it's never
passed through NAT, and never makes it back to 10.0.0.10.
So as it stands now, I don't see that you can use stateful connections
with NAT, unless check-state is changed to allow a packet to be passed
through NAT.
Ken Bolingbroke
hacker@bolingbroke.com