[billincamphill]

I'm trying to use an OSX box with two NICs as a NAT/Firewall. The firewall rules work fine and the NATing from the LAN to the internet works fine, but I can't get the incoming traffic redirected. During this troubling setup my firewall rules have been suspended and I'm allowing any to any. I'm starting natd with a config file that states:
use_sockets yes
same_ports yes
interface en0
redirect_port tcp 192.168.100.22:20-21 20-21 #my LAN's ftpbox

my IPFW rule is divert natd all from any to any

My tcpdumps show when an outside ftp connection comes to my WAN port it is redirected to the LAN port, but with the WANaddress in the packet. Is this correct? Shouldn't it still appear to be from the outside connection? The packet then gets to the ftp server but the ftpserver is replying to the WAN port on my natbox instead of the original ftp client. Nothing ever makes it back to the ftp client and the connection timesout.


NATbox
tcpdump: listening on en0 (WAN)
13:20:13.534497 outsideconnection.49164 > myWANaddress.ftp:
S 3162765832:3162765832(0) win 32768 <mss 1460,wscale 0,nop> (DF)
13:20:13.535898 ftpgateway.ftp > myWANaddress.49164:
S 1644191287:1644191287(0) ack 3162765833 win 33580 <mss 1460,nop,wscale 0> (DF)
13:20:13.536267 myWANaddress.49164 > ftpgateway.ftp:
R 3162765833:3162765833(0) win 0

tcpdump: listening on en1 (LAN)
13:20:13.535364 myWANaddress.49164 > LANftpbox.ftp:
S 3162765832:3162765832(0) win 32768 <mss 1460,wscale 0,nop> (DF)



FTPbox
tcpdump: listening on en0 (LAN's ftp server)
13:20:13.342457 myWANaddress.49164 > LANftpbox.21:
S 3162765832:3162765832(0) win 32768 <mss 1460,wscale 0,nop> (DF)
13:20:13.342586 LANftpbox.21 > myWANaddress.49164:
S 1644191287:1644191287(0) ack 3162765833 win 33580 <mss 1460,nop,wscale 0> (DF)
13:20:13.343537 myWANaddress.49164 > LANftpbox.21:
R 3162765833:3162765833(0) win 0


I know this is simple, but I can't get my ducks in a row. I've been through the man pages like a forensics detective. The apple documentation is nonexistent. The FreeBSD info says I need /etc/rc.conf. I tried making a file with the recommended contents with no luck. Can someone lend a hand please?
Thank you,
Bill

[billincamphill]

Monday morning and another Eagles win later I solved the problem, thought I'd share.
Two issues:
1.My test ftpserver was using a different gateway than the natbox. I changed it to use the natbox.
2.In ipfw I added another another divert natd rule
divert natd all from myLAN to any via en1(LAN)
divert natd all from any to any via en0(WAN)
Now the LAN folks get out correctly and incoming traffic is redirected correctly based on my /etc/natd.conf