2007/10/10, stuart van Zee <stuartv@datalinesys.com>:
quoted text
>
> > From:
> >
> > Hello everybody,
> >
> > I work on BSD 4.1, with i386 hardware.
> >
> > I'm searching a way to enable a transparent firewall (without ip
> adress),
> > probably in bridge mode.., with a capability of NAT. I know the
> > interest is
> > not evident to nat some computers on the same IP lan, but it's
> > for a client,
> > so....!
> >
> > It seems that PF doesn't have this capability. Perhaps, it could
> > be possible
> > with an another package ?
> >
> > Thank's for your comments...
> >
> > Cidric.
>
> I am not sure you understand what NAT is.  When you use NAT to allow a
> system on one network to access another network, the traffic is NATted
> to the IP of the box doing the NAT.  In the case of a firewall like
> device, the traffic would be given the IP address of the outer interface
> of the firewall.
>
> inside box (1)----> firewall/bridge doing nat (2)-----> Internet etc.
>
> (1) network traffic leaves the inside box, it has the source IP of the
> inside box.
>
> (2) The network traffic is NATted by the firewall, when it leaves the
> outer interface of the firewall it now has the source IP address of the
> outer interface of the firewall.
>
> Any return traffic would simply take the same steps in reverse.
>
> If the firewall/bridge does not have any IP addresses, there is no way
> that NAT can occur, It has no IP address to change the source IP to.
>
> If I have this wrong somehow, please let me know.
>
> s
>
> Thank's for your comment. Unfortunately, i well understand the Nat
process.

I's right it's not seems to be interesting to nat some machine in the same
IP lan, but that is what i want.

The problem, you said it very well, it's the firewall can't assign it's own
IP adress because is in bridge mode.

So, the idea is to set a particular IP on all trafic outgoing from the
firewall.
The rule could be this one :

nat pass on bridge0 inet tagged LAN1 -> 192.168.2.3  (it's an example of an
ip pick in the LAN...)
pass in inet proto {tcp,udp, icmp} on $lan1_if <http://10.0.0.0/24> tag LAN1

I don't know if this syntax is ok, because i never tested it.

Someone knows ?