IPFW - why doesn't nuclear NAT work?

Question

FreeBSD

The problem is childish - I decided to transfer the corporate router from linux to fryahu. For the test, I assembled a stand at home. Between my laptop and the router, I crashed a typewriter on a 10.3 freighter.
em0 machine network configuration
: 192.168.0.250 mask 24 gw 192.168.0.1 (my home router), ns 8.8.8.8 the
Internet works on a fryaha. Yandex pings, updated the ports, the software I needed collected
em1: 172.0.0.1 mask 24
I connected my home laptop to em1. assigned him 172.0.0.2 mask / 24 and gateway 172.0.0.1
from the laptop, the fryashny machine also responds, there are no problems at the network level.
rebuilt kernel with
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=50
options IPFIREWALL_NAT
options LIBALIAS
options ROUTETABLES=16
options DUMMYNET
options HZ="1000"
problem now - I can't configure nat!
added to /etc/rc.conf
gateway_enable="YES"
to /etc/rc.local
ipfw add allow ip from any to any
ipfw add nat 1 ip from any to any
rebooted the frey machine.
executed rc.local, ipfw list contains my rules
[email protected]:~ # ipfw list
00100 allow ip from any to any
00200 nat 1 ip from any to any
65535 deny ip from any to any
checked if forwarding was enabled in the
[email protected] kernel :~ # sysctl -a | grep ip.forward
net.inet.ip.forwarding: 1
... and nothing! if I try to ping the same 8.8.8.8 from my laptop (172.0.0.2) I get a timeout...
what is it? oo

Answer 1

The rules in ipfw are parsed in order, and the first allowed rule that fires ends the parsing. Thus, the rules do not work for you beyond 100. It should be something like this:

ipfw add 100 nat 1 all from any to any via em0
ipfw add 200 allow all from any to any

PS By command ipfw show, you can see how many times each rule worked.

Answer 2

There is no need to rebuild the kernel to enable ipfw for modern distributions.
It's been 5 years already.
Have you read some ancient instructions.

Answer 3

allow ip from any to any via lo0