1 .\" manual page [] for natd 1.4
2 .\" $Id: natd.8,v 1.19 1999/06/21 07:58:25 brian Exp $
9 Network Address Translation Daemon
19 .Op Fl f Ar configfile
28 .Op Fl log_facility Ar facility_name
29 .Op Fl unregistered_only
31 .Op Fl inport Ar inport
32 .Op Fl outport Ar outport
34 .Op Fl alias_address Ar address
35 .Op Fl interface Ar interface
36 .Op Fl config Ar configfile
37 .Op Fl redirect_port Ar linkspec
38 .Op Fl redirect_address Ar localIP publicIP
41 .Op Fl proxy_rule Ar proxyspec
42 .Op Fl pptpalias Ar localIP
45 This program provides a Network Address Translation facility for use
48 sockets under FreeBSD. It is intended for use with NICs - if you want
49 to do NAT on a PPP link, use the -alias switch to
54 normally runs in the background as a daemon. It is passed raw IP packets
55 as they travel into and out of the machine, and will possibly change these
56 before re-injecting them back into the IP packet stream.
60 changes all packets destined for another host so that their source
61 IP number is that of the current machine. For each packet changed
62 in this manner, an internal table entry is created to record this
63 fact. The source port number is also changed to indicate the
64 table entry applying to the packet. Packets that are received with
65 a target IP of the current host are checked against this internal
66 table. If an entry is found, it is used to determine the correct
67 target IP number and port to place in the packet.
70 The following command line options are available.
74 Log various aliasing statistics and information to the file
75 .Pa /var/log/alias.log .
76 This file is truncated each time natd is started.
78 .It Fl deny_incoming | d
79 Reject packets destined for the current IP number that have no entry
80 in the internal translation table.
83 Log denied incoming packets via syslog (see also log_facility)
85 .It Fl log_facility Ar facility_name
86 Use specified log facility when logging information via syslog.
87 Facility names are as in
90 .It Fl use_sockets | s
93 in order to establish an FTP data or IRC DCC send connection. This
94 option uses more system resources, but guarantees successful connections
95 when port numbers conflict.
98 Try to keep the same port number when altering outgoing packets.
99 With this option, protocols such as RPC will have a better chance
100 of working. If it is not possible to maintain the port number, it
101 will be silently changed as per normal.
108 on startup. Instead, stay attached to the controling terminal and
109 display all packet alterations to the standard output. This option
110 should only be used for debugging purposes.
112 .It Fl unregistered_only | u
113 Only alter outgoing packets with an unregistered source address.
114 According to rfc 1918, unregistered source addresses are 10.0.0.0/8,
115 172.16.0.0/12 and 192.168.0.0/16.
117 .It Fl redirect_port Ar proto targetIP:targetPORT[-targetPORT] [aliasIP:]aliasPORT[-aliasPORT] [remoteIP[:remotePORT[-remotePORT]]]
118 Redirect incoming connections arriving to given port(s) to another host
120 Proto is either tcp or udp, targetIP is the desired target IP
121 number, targetPORT is the desired target PORT number or range, aliasPORT
122 is the requested PORT number or range, and aliasIP is the aliasing address.
123 RemoteIP and remotePORT can be used to specify the connection
124 more accurately if necessary.
125 The targetPORT range and aliasPORT range need not be the same numerically,
126 but must have the same size.
127 If remotePORT is not specified, it is assumed to be all ports.
128 If remotePORT is specified, it must match the size of targetPORT, or be 0
130 For example, the argument
132 .Dl Ar tcp inside1:telnet 6666
134 means that incoming tcp packets destined for port 6666 on this machine will
135 be sent to the telnet port on the inside1 machine.
137 .Dl Ar tcp inside2:2300-2399 3300-3399
139 will redirect incoming connections on ports 3300-3399 to host
140 inside2, ports 2300-2399.
141 The mapping is 1:1 meaning port 3300 maps to 2300, 3301 maps to 2301, etc.
143 .It Fl redirect_address Ar localIP publicIP
144 Redirect traffic for public IP address to a machine on the local
145 network. This function is known as "static NAT". Normally static NAT
146 is useful if your ISP has allocated a small block of IP addresses to you,
147 but it can even be used in the case of single address:
149 redirect_address 10.0.0.8 0.0.0.0
151 The above command would redirect all incoming traffic
154 If several address aliases specify the same public address
157 redirect_address 192.168.0.2 public_addr
158 redirect_address 192.168.0.3 public_addr
159 redirect_address 192.168.0.4 public_addr
161 the incoming traffic will be directed to the last
162 translated local address (192.168.0.4), but outgoing
163 traffic to the first two addresses will still be aliased
164 to specified public address.
173 will monitor the routing socket for alterations to the
175 passed. If the interfaces IP number is changed,
177 will dynamically alter its concept of the alias address.
179 .It Fl i | inport Ar inport
180 Read from and write to
182 treating all packets as packets coming into the machine.
184 .It Fl o | outport Ar outport
185 Read from and write to
187 treating all packets as packets going out of the machine.
189 .It Fl p | port Ar port
190 Read from and write to
192 distinguishing packets as incoming our outgoing using the rules specified in
196 is not numeric, it is searched for in the
200 function. If this flag is not specified, the divert port named natd will
201 be used as a default. An example entry in the
205 natd 8668/divert # Network Address Translation socket
211 .It Fl a | alias_address Ar address
214 as the alias address. If this option is not specified, the
218 option must be used. The specified address should be the address assigned
219 to the public network interface.
221 All data passing out through this addresses interface will be rewritten
222 with a source address equal to
224 All data arriving at the interface from outside will be checked to
225 see if it matches any already-aliased outgoing connection. If it does,
226 the packet is altered accordingly. If not, all
230 assignments are checked and actioned. If no other action can be made,
233 is not specified, the packet is delivered to the local machine and port
234 as specified in the packet.
236 .It Fl n | interface Ar interface
239 to determine the alias address. If there is a possibility that the
240 IP number associated with
244 flag should also be used. If this option is not specified, the
252 must be the public network interface.
253 .It Fl f | config Ar configfile
254 Read configuration from
257 contains a list of options, one per line in the same form as the
258 long form of the above command line flags. For example, the line
260 alias_address 158.152.17.1
262 would specify an alias address of 158.152.17.1. Options that don't
263 take an argument are specified with an option of
267 in the configuration file. For example, the line
273 Empty lines and lines beginning with '#' are ignored.
276 Reverse operation of natd. This can be useful in some
277 transparent proxying situations when outgoing traffic
278 is redirected to the local machine and natd is running on the
279 incoming interface (it usually runs on the outgoing interface).
282 Force natd to perform transparent proxying
283 only. Normal address translation is not performed.
285 .It Fl proxy_rule Ar [type encode_ip_hdr|encode_tcp_stream] port xxxx server a.b.c.d:yyyy
286 Enable transparent proxying. Packets with the given port going through this
287 host to any other host are redirected to the given server and port.
288 Optionally, the original target address can be encoded into the packet. Use
290 to put this information into the IP option field or
291 .Dq encode_tcp_stream
292 to inject the data into the beginning of the TCP stream.
294 .It Fl pptpalias Ar localIP
295 Allow PPTP packets to go to the defined localIP address. PPTP is a VPN or secure
296 IP tunneling technology being developed primarily by Microsoft. For its encrypted traffic,
297 it uses an old IP encapsulation protocol called GRE (47). This
298 natd option will translate any traffic of this protocol to a
299 single, specified IP address. This would allow either one client or one server
300 to be serviced with natd. If you are setting up a server, don't forget to allow the TCP traffic
301 for the PPTP setup. For a client or server, you must allow GRE (protocol 47) if you have firewall lists active.
306 The following steps are necessary before attempting to run
311 Get FreeBSD version 2.2 or higher. Versions before this do not support
316 Build a custom kernel with the following options:
321 Refer to the handbook for detailed instructions on building a custom
325 Ensure that your machine is acting as a gateway. This can be done by
334 sysctl -w net.inet.ip.forwarding=1
337 If you wish to use the
341 flags, make sure that your interface is already configured. If, for
342 example, you wish to specify tun0 as your
346 on that interface, you must make sure that you start
355 natd 8668/divert # Network Address Translation socket
357 This gives a default for the
367 is fairly straight forward. The line
371 should suffice in most cases (substituting the correct interface name). Once
373 is running, you must ensure that traffic is diverted to natd:
377 You will need to adjust the
379 script to taste. If you're not interested in having a firewall, the
380 following lines will do:
383 /sbin/ipfw add divert natd all from any to any via ed0
384 /sbin/ipfw add pass all from any to any
386 The second line depends on your interface (change ed0 as appropriate)
387 and assumes that you've updated
389 with the natd entry as above. If you specify real firewall rules, it's
390 best to specify line 2 at the start of the script so that
392 sees all packets before they are dropped by the firewall. The firewall
393 rules will be run again on each packet after translation by
395 minus any divert rules.
398 Enable your firewall by setting
404 This tells the system startup scripts to run the
406 script. If you don't wish to reboot now, just run this by hand from the
407 console. NEVER run this from a virtual session unless you put it into
408 the background. If you do, you'll lock yourself out after the flush
409 takes place, and execution of
411 will stop at this point - blocking all accesses permanently. Running
412 the script in the background should be enough to prevent this disaster.
417 .Xr getservbyname 2 ,
424 This program is the result of the efforts of many people at different
427 .An Archie Cobbs Aq archie@whistle.com
429 .An Charles Mott Aq cmott@srv.net
431 .An Eivind Eklund Aq perhaps@yes.no
432 (IRC support & misc additions)
433 .An Ari Suutari Aq suutari@iki.fi
435 .An Dru Nelson Aq dnelson@redwoodsoft.com
437 .An Brian Somers Aq brian@awfulhak.org