1 .\" manual page [] for natd 1.4
9 Network Address Translation Daemon
19 .Op Fl f Ar configfile
28 .Op Fl log_facility Ar facility_name
29 .Op Fl unregistered_only
31 .Op Fl inport Ar inport
32 .Op Fl outport Ar outport
34 .Op Fl alias_address Ar address
35 .Op Fl interface Ar interface
36 .Op Fl config Ar configfile
37 .Op Fl redirect_port Ar linkspec
38 .Op Fl redirect_address Ar localIP publicIP
41 .Op Fl proxy_rule Ar proxyspec
42 .Op Fl pptpalias Ar localIP
45 This program provides a Network Address Translation facility for use
48 sockets under FreeBSD. It is intended for use with NICs - if you want
49 to do NAT on a PPP link, use the -alias switch to
54 normally runs in the background as a daemon. It is passed raw IP packets
55 as they travel into and out of the machine, and will possibly change these
56 before re-injecting them back into the IP packet stream.
60 changes all packets destined for another host so that their source
61 IP number is that of the current machine. For each packet changed
62 in this manner, an internal table entry is created to record this
63 fact. The source port number is also changed to indicate the
64 table entry applying to the packet. Packets that are received with
65 a target IP of the current host are checked against this internal
66 table. If an entry is found, it is used to determine the correct
67 target IP number and port to place in the packet.
70 The following command line options are available.
74 Log various aliasing statistics and information to the file
75 .Pa /var/log/alias.log .
76 This file is truncated each time natd is started.
78 .It Fl deny_incoming | d
79 Reject packets destined for the current IP number that have no entry
80 in the internal translation table.
83 Log denied incoming packets via syslog (see also log_facility)
85 .It Fl log_facility Ar facility_name
86 Use specified log facility when logging information via syslog.
87 Facility names are as in
90 .It Fl use_sockets | s
93 in order to establish an FTP data or IRC DCC send connection. This
94 option uses more system resources, but guarantees successful connections
95 when port numbers conflict.
98 Try to keep the same port number when altering outgoing packets.
99 With this option, protocols such as RPC will have a better chance
100 of working. If it is not possible to maintain the port number, it
101 will be silently changed as per normal.
108 on startup. Instead, stay attached to the controling terminal and
109 display all packet alterations to the standard output. This option
110 should only be used for debugging purposes.
112 .It Fl unregistered_only | u
113 Only alter outgoing packets with an unregistered source address.
114 According to rfc 1918, unregistered source addresses are 10.0.0.0/8,
115 172.16.0.0/12 and 192.168.0.0/16.
117 .It Fl redirect_port Ar proto targetIP:targetPORT[-targetPORT] [aliasIP:]aliasPORT[-aliasPORT] [remoteIP[:remotePORT[-remotePORT]]]
118 Redirect incoming connections arriving to given port(s) to another host
120 Proto is either tcp or udp, targetIP is the desired target IP
121 number, targetPORT is the desired target PORT number or range, aliasPORT
122 is the requested PORT number or range, and aliasIP is the aliasing address.
123 RemoteIP and remotePORT can be used to specify the connection
124 more accurately if necessary.
125 The targetPORT range and aliasPORT range need not be the same numerically,
126 but must have the same size.
127 If remotePORT is not specified, it is assumed to be all ports.
128 If remotePORT is specified, it must match the size of targetPORT, or be 0
130 For example, the argument
132 .Dl Ar tcp inside1:telnet 6666
134 means that incoming tcp packets destined for port 6666 on this machine will
135 be sent to the telnet port on the inside1 machine.
137 .Dl Ar tcp inside2:2300-2399 3300-3399
139 will redirect incoming connections on ports 3300-3399 to host
140 inside2, ports 2300-2399.
141 The mapping is 1:1 meaning port 3300 maps to 2300, 3301 maps to 2301, etc.
143 .It Fl redirect_address Ar localIP publicIP
144 Redirect traffic for public IP address to a machine on the local
145 network. This function is known as "static NAT". Normally static NAT
146 is useful if your ISP has allocated a small block of IP addresses to you,
147 but it can even be used in the case of single address:
149 redirect_address 10.0.0.8 0.0.0.0
151 The above command would redirect all incoming traffic
154 If several address aliases specify the same public address
157 redirect_address 192.168.0.2 public_addr
158 redirect_address 192.168.0.3 public_addr
159 redirect_address 192.168.0.4 public_addr
161 the incoming traffic will be directed to the last
162 translated local address (192.168.0.4), but outgoing
163 traffic to the first two addresses will still be aliased
164 to specified public address.
173 will monitor the routing socket for alterations to the
175 passed. If the interfaces IP number is changed,
177 will dynamically alter its concept of the alias address.
179 .It Fl i | inport Ar inport
180 Read from and write to
182 treating all packets as packets coming into the machine.
184 .It Fl o | outport Ar outport
185 Read from and write to
187 treating all packets as packets going out of the machine.
189 .It Fl p | port Ar port
190 Read from and write to
192 distinguishing packets as incoming our outgoing using the rules specified in
196 is not numeric, it is searched for in the
200 function. If this flag is not specified, the divert port named natd will
201 be used as a default. An example entry in the
205 natd 8668/divert # Network Address Translation socket
211 .It Fl a | alias_address Ar address
214 as the alias address. If this option is not specified, the
218 option must be used. The specified address should be the address assigned
219 to the public network interface.
221 All data passing out through this addresses interface will be rewritten
222 with a source address equal to
224 All data arriving at the interface from outside will be checked to
225 see if it matches any already-aliased outgoing connection. If it does,
226 the packet is altered accordingly. If not, all
230 assignments are checked and actioned. If no other action can be made,
233 is not specified, the packet is delivered to the local machine and port
234 as specified in the packet.
236 .It Fl n | interface Ar interface
239 to determine the alias address. If there is a possibility that the
240 IP number associated with
244 flag should also be used. If this option is not specified, the
252 must be the public network interface.
253 .It Fl f | config Ar configfile
254 Read configuration from
257 contains a list of options, one per line in the same form as the
258 long form of the above command line flags. For example, the line
260 alias_address 158.152.17.1
262 would specify an alias address of 158.152.17.1. Options that don't
263 take an argument are specified with an option of
267 in the configuration file. For example, the line
274 Trailing spaces and empty lines are ignored.
277 sign will mark the rest of the line as a comment.
280 Reverse operation of natd. This can be useful in some
281 transparent proxying situations when outgoing traffic
282 is redirected to the local machine and natd is running on the
283 incoming interface (it usually runs on the outgoing interface).
286 Force natd to perform transparent proxying
287 only. Normal address translation is not performed.
289 .It Fl proxy_rule Ar [type encode_ip_hdr|encode_tcp_stream] port xxxx server a.b.c.d:yyyy
290 Enable transparent proxying. Packets with the given port going through this
291 host to any other host are redirected to the given server and port.
292 Optionally, the original target address can be encoded into the packet. Use
294 to put this information into the IP option field or
295 .Dq encode_tcp_stream
296 to inject the data into the beginning of the TCP stream.
298 .It Fl pptpalias Ar localIP
299 Allow PPTP packets to go to the defined localIP address. PPTP is a VPN or secure
300 IP tunneling technology being developed primarily by Microsoft. For its encrypted traffic,
301 it uses an old IP encapsulation protocol called GRE (47). This
302 natd option will translate any traffic of this protocol to a
303 single, specified IP address. This would allow either one client or one server
304 to be serviced with natd. If you are setting up a server, don't forget to allow the TCP traffic
305 for the PPTP setup. For a client or server, you must allow GRE (protocol 47) if you have firewall lists active.
310 The following steps are necessary before attempting to run
315 Get FreeBSD version 2.2 or higher. Versions before this do not support
320 Build a custom kernel with the following options:
325 Refer to the handbook for detailed instructions on building a custom
329 Ensure that your machine is acting as a gateway. This can be done by
338 sysctl -w net.inet.ip.forwarding=1
341 If you wish to use the
345 flags, make sure that your interface is already configured. If, for
346 example, you wish to specify tun0 as your
350 on that interface, you must make sure that you start
359 natd 8668/divert # Network Address Translation socket
361 This gives a default for the
371 is fairly straight forward. The line
375 should suffice in most cases (substituting the correct interface name). Once
377 is running, you must ensure that traffic is diverted to natd:
381 You will need to adjust the
383 script to taste. If you're not interested in having a firewall, the
384 following lines will do:
387 /sbin/ipfw add divert natd all from any to any via ed0
388 /sbin/ipfw add pass all from any to any
390 The second line depends on your interface (change ed0 as appropriate)
391 and assumes that you've updated
393 with the natd entry as above. If you specify real firewall rules, it's
394 best to specify line 2 at the start of the script so that
396 sees all packets before they are dropped by the firewall.
400 packets re-enter the firewall at the rule number following the rule number
401 that caused the diversion (not the next rule if there are several at the
405 Enable your firewall by setting
411 This tells the system startup scripts to run the
413 script. If you don't wish to reboot now, just run this by hand from the
414 console. NEVER run this from a virtual session unless you put it into
415 the background. If you do, you'll lock yourself out after the flush
416 takes place, and execution of
418 will stop at this point - blocking all accesses permanently. Running
419 the script in the background should be enough to prevent this disaster.
425 .Xr getservbyname 3 ,
431 This program is the result of the efforts of many people at different
434 .An Archie Cobbs Aq archie@whistle.com
436 .An Charles Mott Aq cmott@srv.net
438 .An Eivind Eklund Aq perhaps@yes.no
439 (IRC support & misc additions)
440 .An Ari Suutari Aq suutari@iki.fi
442 .An Dru Nelson Aq dnelson@redwoodsoft.com
444 .An Brian Somers Aq brian@awfulhak.org