Multi homed firewall with ipnat

Question

i am trying (without success) to configure a ipnat/ipf box under FreeBSD 8.2, here is the scenario:

outside                                  inside
                              +----+
ADSL 1.2.3.0/29 -------(re0)- |    | -(re2)-- 172.16.16.0/254  DMZ
                              |    | 
HDSL 101.102.103.0/29 -(re1)- |    | -(re3)-- 192.168.10.0/254 LAN
                              +----+

Until now i had only the ADSL and i was able to navigate from the LAN and to redirect incoming requests to various services into the DMZ,

the default gateway for the box is 1.2.3.4 all the assigned ip addresses are aliased to the respective interfaces

here is my ipnat.conf

# -------------------------------
# navigation from inside 
map re0 192.168.10.0/24 -> 1.2.3.4/32 proxy port ftp ftp/tcp
map re0 192.168.10.0/24 -> 1.2.3.4/32 portmap tcp/udp 11000:39999
map re0 192.168.10.0/24 -> 1.2.3.4/32

map re0 172.16.16.0/24 -> 1.2.3.4/32 proxy port ftp ftp/tcp
map re0 172.16.16.0/24 -> 1.2.3.4/32 portmap tcp/udp 40000:59999
map re0 172.16.16.0/24 -> 1.2.3.4/32

# some services
rdr re0 1.2.3.2/32 port 80   -> 172.16.16.100  port   80 tcp/udp
rdr re0 1.2.3.3/32 port 25   -> 172.16.16.200  port   25 tcp/udp
rdr re0 1.2.3.3/32 port 110  -> 172.16.16.200  port  110 tcp/udp
rdr re0 1.2.3.5/32 port 3389 -> 192.168.10.10  port 3389 tcp/udp
# -------------------------------

now i would configure the box so that, some services would be accessed via the new HDSL connection, something like:

# -------------------------------
# navigation from inside 
map re0 192.168.10.0/24 -> 1.2.3.4/32 proxy port ftp ftp/tcp
map re0 192.168.10.0/24 -> 1.2.3.4/32 portmap tcp/udp 11000:39999
map re0 192.168.10.0/24 -> 1.2.3.4/32

map re0 172.16.16.0/24 -> 1.2.3.4/32 proxy port ftp ftp/tcp
map re0 172.16.16.0/24 -> 1.2.3.4/32 portmap tcp/udp 40000:59999
map re0 172.16.16.0/24 -> 1.2.3.4/32

# some services via ADSL and some via HDSL
rdr re0 1.2.3.2/32         port 80   -> 172.16.16.100  port   80 tcp/udp
rdr re1 101.102.103.103/32 port 25   -> 172.16.16.200  port   25 tcp/udp
rdr re1 101.102.103.103/32 port 110  -> 172.16.16.200  port  110 tcp/udp
rdr re0 1.2.3.5/32         port 3389 -> 192.168.10.10  port 3389 tcp/udp
# -------------------------------

but i am not able to setup things as i would ... incoming packets are routed to the right destination, but replies go elsewhere, i have also tried with maps and bimaps with the same (if not worst ;-) ...) results.

Sorry for the long post, many grateful thanks to anyone that will help !

Answer 1

While I can't say exactly how you would do it with freeBSD (as I've never used it seriously) I think you should spend some time reading through the pf man pages, and pay attention to the routing section, especially these two sections:

route-to
       The route-to option routes the packet to the specified interface
       with an optional address for the next hop.  When a route-to rule
       creates state, only packets that pass in the same direction as the
       filter rule specifies will be routed in this way.  Packets passing
       in the opposite direction (replies) are not affected and are routed
       normally.

and

reply-to
       The reply-to option is similar to route-to, but routes packets that
       pass in the opposite direction (replies) to the specified inter-
       face.  Opposite direction is only defined in the context of a state
       entry, and reply-to is useful only in rules that create state.  It
       can be used on systems with multiple external connections to route
       all outgoing packets of a connection through the interface the
       incoming connection arrived through (symmetric routing enforce-
       ment).