1997-06-22 04:19:08 +00:00
|
|
|
.\" manual page [] for natd 1.4
|
1999-08-28 00:22:10 +00:00
|
|
|
.\" $FreeBSD$
|
1997-06-22 04:19:08 +00:00
|
|
|
.Dd 15 April 1997
|
|
|
|
.Os FreeBSD
|
|
|
|
.Dt NATD 8
|
|
|
|
.Sh NAME
|
|
|
|
.Nm natd
|
|
|
|
.Nd
|
|
|
|
Network Address Translation Daemon
|
|
|
|
.Sh SYNOPSIS
|
|
|
|
.Nm
|
|
|
|
.Op Fl ldsmvu
|
|
|
|
.Op Fl dynamic
|
|
|
|
.Op Fl i Ar inport
|
|
|
|
.Op Fl o Ar outport
|
|
|
|
.Op Fl p Ar port
|
|
|
|
.Op Fl a Ar address
|
2000-05-18 10:31:10 +00:00
|
|
|
.Op Fl t Ar address
|
1998-04-18 10:05:38 +00:00
|
|
|
.Op Fl n Ar interface
|
1997-06-22 04:19:08 +00:00
|
|
|
.Op Fl f Ar configfile
|
|
|
|
|
|
|
|
.Nm
|
|
|
|
.Op Fl log
|
|
|
|
.Op Fl deny_incoming
|
1999-03-07 18:23:56 +00:00
|
|
|
.Op Fl log_denied
|
1997-06-22 04:19:08 +00:00
|
|
|
.Op Fl use_sockets
|
|
|
|
.Op Fl same_ports
|
|
|
|
.Op Fl verbose
|
1999-03-07 18:23:56 +00:00
|
|
|
.Op Fl log_facility Ar facility_name
|
1997-06-22 04:19:08 +00:00
|
|
|
.Op Fl unregistered_only
|
|
|
|
.Op Fl dynamic
|
|
|
|
.Op Fl inport Ar inport
|
|
|
|
.Op Fl outport Ar outport
|
|
|
|
.Op Fl port Ar port
|
|
|
|
.Op Fl alias_address Ar address
|
2000-05-18 10:31:10 +00:00
|
|
|
.Op Fl target_address Ar address
|
1997-06-22 04:19:08 +00:00
|
|
|
.Op Fl interface Ar interface
|
|
|
|
.Op Fl config Ar configfile
|
1997-10-18 16:31:28 +00:00
|
|
|
.Op Fl redirect_port Ar linkspec
|
2000-05-03 15:06:45 +00:00
|
|
|
.Op Fl redirect_proto Ar linkspec
|
2000-04-27 17:55:17 +00:00
|
|
|
.Op Fl redirect_address Ar linkspec
|
1999-03-07 18:23:56 +00:00
|
|
|
.Op Fl reverse
|
|
|
|
.Op Fl proxy_only
|
|
|
|
.Op Fl proxy_rule Ar proxyspec
|
1997-06-22 04:19:08 +00:00
|
|
|
|
|
|
|
.Sh DESCRIPTION
|
|
|
|
This program provides a Network Address Translation facility for use
|
|
|
|
with
|
|
|
|
.Xr divert 4
|
2000-06-26 14:44:31 +00:00
|
|
|
sockets under FreeBSD.
|
|
|
|
It is intended for use with NICs -
|
|
|
|
if you want to do NAT on a PPP link,
|
|
|
|
use the -nat switch to
|
1999-04-08 23:15:31 +00:00
|
|
|
.Xr ppp 8 .
|
1997-06-22 04:19:08 +00:00
|
|
|
|
|
|
|
.Pp
|
|
|
|
.Nm Natd
|
2000-06-26 14:44:31 +00:00
|
|
|
normally runs in the background as a daemon.
|
|
|
|
It is passed raw IP packets as they travel into and out of the machine,
|
|
|
|
and will possibly change these before re-injecting them back
|
|
|
|
into the IP packet stream.
|
1997-06-22 04:19:08 +00:00
|
|
|
|
|
|
|
.Pp
|
|
|
|
.Nm Natd
|
2000-06-26 14:44:31 +00:00
|
|
|
changes all packets destined for another host
|
|
|
|
so that their source IP number is that of the current machine.
|
|
|
|
For each packet changed in this manner,
|
|
|
|
an internal table entry is created to record this fact.
|
|
|
|
The source port number is also changed
|
|
|
|
to indicate the table entry applying to the packet.
|
|
|
|
Packets that are received with a target IP of the current host
|
|
|
|
are checked against this internal table.
|
|
|
|
If an entry is found,
|
|
|
|
it is used to determine the correct target IP number and port
|
|
|
|
to place in the packet.
|
1997-06-22 04:19:08 +00:00
|
|
|
.Pp
|
|
|
|
The following command line options are available.
|
|
|
|
.Bl -tag -width Fl
|
|
|
|
.It Fl log | l
|
|
|
|
Log various aliasing statistics and information to the file
|
|
|
|
.Pa /var/log/alias.log .
|
|
|
|
This file is truncated each time natd is started.
|
|
|
|
.It Fl deny_incoming | d
|
2000-06-26 14:44:31 +00:00
|
|
|
Reject packets destined for the current IP number
|
|
|
|
that have no entry in the internal translation table.
|
1999-03-07 18:23:56 +00:00
|
|
|
.It Fl log_denied
|
|
|
|
Log denied incoming packets via syslog (see also log_facility)
|
|
|
|
.It Fl log_facility Ar facility_name
|
|
|
|
Use specified log facility when logging information via syslog.
|
|
|
|
Facility names are as in
|
|
|
|
.Xr syslog.conf 5
|
1997-06-22 04:19:08 +00:00
|
|
|
.It Fl use_sockets | s
|
|
|
|
Allocate a
|
|
|
|
.Xr socket 2
|
2000-06-26 14:44:31 +00:00
|
|
|
in order to establish an FTP data or IRC DCC send connection.
|
|
|
|
This option uses more system resources,
|
|
|
|
but guarantees successful connections when port numbers conflict.
|
1997-06-22 04:19:08 +00:00
|
|
|
.It Fl same_ports | m
|
|
|
|
Try to keep the same port number when altering outgoing packets.
|
2000-06-26 14:44:31 +00:00
|
|
|
With this option,
|
|
|
|
protocols such as RPC will have a better chance of working.
|
|
|
|
If it is not possible to maintain the port number,
|
|
|
|
it will be silently changed as per normal.
|
1997-06-22 04:19:08 +00:00
|
|
|
.It Fl verbose | v
|
|
|
|
Don't call
|
|
|
|
.Xr fork 2
|
|
|
|
or
|
|
|
|
.Xr daemon 3
|
2000-06-26 14:44:31 +00:00
|
|
|
on startup.
|
|
|
|
Instead, stay attached to the controling terminal and
|
|
|
|
display all packet alterations to the standard output.
|
|
|
|
This option should only be used for debugging purposes.
|
1997-06-22 04:19:08 +00:00
|
|
|
.It Fl unregistered_only | u
|
|
|
|
Only alter outgoing packets with an unregistered source address.
|
2000-06-26 14:44:31 +00:00
|
|
|
According to rfc 1918,
|
|
|
|
unregistered source addresses are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
|
1999-05-13 16:58:31 +00:00
|
|
|
.It Fl redirect_port Ar proto targetIP:targetPORT[-targetPORT] [aliasIP:]aliasPORT[-aliasPORT] [remoteIP[:remotePORT[-remotePORT]]]
|
|
|
|
Redirect incoming connections arriving to given port(s) to another host
|
|
|
|
and port(s).
|
2000-06-26 14:44:31 +00:00
|
|
|
.Ar Proto
|
|
|
|
is either tcp or udp,
|
|
|
|
.Ar targetIP
|
|
|
|
is the desired target IP number,
|
|
|
|
.Ar targetPORT
|
|
|
|
is the desired target PORT number or range,
|
|
|
|
.Ar aliasPORT
|
|
|
|
is the requested PORT number or range,
|
|
|
|
and
|
|
|
|
.Ar aliasIP
|
|
|
|
is the aliasing address.
|
|
|
|
.Ar RemoteIP
|
|
|
|
and
|
|
|
|
.Ar remotePORT
|
|
|
|
can be used to specify the connection more accurately if necessary.
|
|
|
|
The
|
|
|
|
.Ar targetPORT
|
|
|
|
range and
|
|
|
|
.Ar aliasPORT
|
|
|
|
range need not be the same numerically,
|
1999-05-13 16:58:31 +00:00
|
|
|
but must have the same size.
|
2000-06-26 14:44:31 +00:00
|
|
|
If
|
|
|
|
.Ar remotePORT
|
|
|
|
is not specified,
|
|
|
|
it is assumed to be all ports.
|
|
|
|
If
|
|
|
|
.Ar remotePORT
|
|
|
|
is specified,
|
|
|
|
it must match the size of targetPORT,
|
|
|
|
or be 0
|
1999-05-13 16:58:31 +00:00
|
|
|
(all ports).
|
2000-06-26 14:44:31 +00:00
|
|
|
For example,
|
|
|
|
the argument
|
|
|
|
.Pp
|
1999-06-21 07:58:25 +00:00
|
|
|
.Dl Ar tcp inside1:telnet 6666
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
1999-06-21 07:58:25 +00:00
|
|
|
means that incoming tcp packets destined for port 6666 on this machine will
|
1997-06-22 04:19:08 +00:00
|
|
|
be sent to the telnet port on the inside1 machine.
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
1999-06-21 07:58:25 +00:00
|
|
|
.Dl Ar tcp inside2:2300-2399 3300-3399
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
1999-05-13 16:58:31 +00:00
|
|
|
will redirect incoming connections on ports 3300-3399 to host
|
|
|
|
inside2, ports 2300-2399.
|
|
|
|
The mapping is 1:1 meaning port 3300 maps to 2300, 3301 maps to 2301, etc.
|
2000-05-03 15:06:45 +00:00
|
|
|
.It Fl redirect_proto Ar proto localIP Xo
|
|
|
|
.Op Ar publicIP Op Ar remoteIP
|
|
|
|
.Xc
|
|
|
|
Redirect incoming IP packets of protocol
|
|
|
|
.Ar proto
|
|
|
|
.Pq see Xr protocols 5
|
|
|
|
destined for
|
|
|
|
.Ar publicIP
|
|
|
|
address to a
|
|
|
|
.Ar localIP
|
|
|
|
address and vice versa.
|
|
|
|
.Pp
|
|
|
|
If
|
|
|
|
.Ar publicIP
|
2000-06-26 14:44:31 +00:00
|
|
|
is not specified,
|
|
|
|
then the default aliasing address is used.
|
2000-05-03 15:06:45 +00:00
|
|
|
If
|
|
|
|
.Ar remoteIP
|
2000-06-26 14:44:31 +00:00
|
|
|
is specified,
|
|
|
|
then only packets coming from/to
|
2000-05-03 15:06:45 +00:00
|
|
|
.Ar remoteIP
|
|
|
|
will match the rule.
|
1997-06-22 04:19:08 +00:00
|
|
|
.It Fl redirect_address Ar localIP publicIP
|
2000-06-26 14:44:31 +00:00
|
|
|
Redirect traffic for public IP address to a machine on the local network.
|
|
|
|
This function is known as "static NAT".
|
|
|
|
Normally static NAT is useful
|
|
|
|
if your ISP has allocated a small block of IP addresses to you,
|
1997-06-22 04:19:08 +00:00
|
|
|
but it can even be used in the case of single address:
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
|
|
|
.Dl Ar redirect_address 10.0.0.8 0.0.0.0
|
|
|
|
.Pp
|
|
|
|
The above command would redirect all incoming traffic to machine 10.0.0.8.
|
|
|
|
.Pp
|
|
|
|
If several address aliases specify the same public address as follows
|
|
|
|
.Pp
|
|
|
|
.Dl Ar redirect_address 192.168.0.2 public_addr
|
|
|
|
.Dl Ar redirect_address 192.168.0.3 public_addr
|
|
|
|
.Dl Ar redirect_address 192.168.0.4 public_addr
|
|
|
|
.Pp
|
1997-06-22 04:19:08 +00:00
|
|
|
the incoming traffic will be directed to the last
|
2000-06-26 14:44:31 +00:00
|
|
|
translated local address (192.168.0.4),
|
|
|
|
but outgoing traffic to the first two addresses will still be aliased
|
1997-06-22 04:19:08 +00:00
|
|
|
to specified public address.
|
2000-04-27 17:55:17 +00:00
|
|
|
.It Fl redirect_port Ar proto Xo
|
|
|
|
.Ar targetIP Ns : Ns Xo
|
|
|
|
.Ar targetPORT Ns Oo , Ns
|
|
|
|
.Ar targetIP Ns : Ns Xo
|
|
|
|
.Ar targetPORT Ns Oo , Ns
|
|
|
|
.Ar ...
|
|
|
|
.Oc Oc
|
|
|
|
.Xc
|
|
|
|
.Xc
|
|
|
|
.Op Ar aliasIP Ns : Ns Xo
|
|
|
|
.Ar aliasPORT
|
|
|
|
.Xc
|
|
|
|
.Oo Ar remoteIP Ns
|
|
|
|
.Op : Ns Ar remotePORT
|
|
|
|
.Oc
|
|
|
|
.Xc
|
|
|
|
.It Fl redirect_address Xo
|
|
|
|
.Ar localIP Ns Oo , Ns
|
|
|
|
.Ar localIP Ns Oo , Ns
|
|
|
|
.Ar ...
|
|
|
|
.Oc Oc
|
|
|
|
.Ar publicIP
|
|
|
|
.Xc
|
|
|
|
These forms of
|
|
|
|
.Fl redirect_port
|
|
|
|
and
|
|
|
|
.Fl redirect_address
|
|
|
|
are used to transparently offload network load on a single server and
|
|
|
|
distribute the load across a pool of servers.
|
|
|
|
This function is known as
|
|
|
|
.Em LSNAT
|
|
|
|
(RFC 2391).
|
2000-06-26 14:44:31 +00:00
|
|
|
For example,
|
|
|
|
the argument
|
2000-04-27 17:55:17 +00:00
|
|
|
.Pp
|
|
|
|
.Dl Ar tcp www1:http,www2:http,www3:http www:http
|
|
|
|
.Pp
|
|
|
|
means that incoming HTTP requests for host www will be transparently
|
2000-06-26 14:44:31 +00:00
|
|
|
redirected to one of the www1, www2 or www3,
|
|
|
|
where a host is selected simply on a round-robin basis,
|
|
|
|
without regard to load on the net.
|
1997-06-22 04:19:08 +00:00
|
|
|
.It Fl dynamic
|
|
|
|
If the
|
|
|
|
.Fl n
|
|
|
|
or
|
|
|
|
.Fl interface
|
|
|
|
option is used,
|
1997-10-02 11:43:33 +00:00
|
|
|
.Nm
|
1997-06-22 04:19:08 +00:00
|
|
|
will monitor the routing socket for alterations to the
|
|
|
|
.Ar interface
|
2000-06-26 14:44:31 +00:00
|
|
|
passed.
|
|
|
|
If the interfaces IP number is changed,
|
1997-10-02 11:43:33 +00:00
|
|
|
.Nm
|
1997-06-22 04:19:08 +00:00
|
|
|
will dynamically alter its concept of the alias address.
|
|
|
|
.It Fl i | inport Ar inport
|
|
|
|
Read from and write to
|
|
|
|
.Ar inport ,
|
|
|
|
treating all packets as packets coming into the machine.
|
|
|
|
.It Fl o | outport Ar outport
|
|
|
|
Read from and write to
|
|
|
|
.Ar outport ,
|
|
|
|
treating all packets as packets going out of the machine.
|
|
|
|
.It Fl p | port Ar port
|
|
|
|
Read from and write to
|
|
|
|
.Ar port ,
|
|
|
|
distinguishing packets as incoming our outgoing using the rules specified in
|
|
|
|
.Xr divert 4 .
|
|
|
|
If
|
|
|
|
.Ar port
|
|
|
|
is not numeric, it is searched for in the
|
|
|
|
.Pa /etc/services
|
|
|
|
database using the
|
|
|
|
.Xr getservbyname 3
|
2000-06-26 14:44:31 +00:00
|
|
|
function.
|
|
|
|
If this flag is not specified,
|
|
|
|
the divert port named natd will be used as a default.
|
|
|
|
An example entry in the
|
1997-06-22 04:19:08 +00:00
|
|
|
.Pa /etc/services
|
|
|
|
database would be:
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
|
|
|
natd 8668/divert # Network Address Translation socket
|
|
|
|
.Pp
|
1997-06-22 04:19:08 +00:00
|
|
|
Refer to
|
|
|
|
.Xr services 5
|
|
|
|
for further details.
|
|
|
|
.It Fl a | alias_address Ar address
|
|
|
|
Use
|
|
|
|
.Ar address
|
2000-06-26 14:44:31 +00:00
|
|
|
as the alias address.
|
|
|
|
If this option is not specified, the
|
1997-06-22 04:19:08 +00:00
|
|
|
.Fl n
|
|
|
|
or
|
|
|
|
.Fl interface
|
2000-06-26 14:44:31 +00:00
|
|
|
option must be used.
|
|
|
|
The specified address should be the address assigned
|
1998-01-29 00:40:41 +00:00
|
|
|
to the public network interface.
|
|
|
|
.Pp
|
|
|
|
All data passing out through this addresses interface will be rewritten
|
|
|
|
with a source address equal to
|
|
|
|
.Ar address .
|
|
|
|
All data arriving at the interface from outside will be checked to
|
2000-06-26 14:44:31 +00:00
|
|
|
see if it matches any already-aliased outgoing connection.
|
|
|
|
If it does,
|
|
|
|
the packet is altered accordingly.
|
|
|
|
If not,
|
|
|
|
all
|
1998-01-29 00:40:41 +00:00
|
|
|
.Fl redirect_port
|
|
|
|
and
|
|
|
|
.Fl redirect_address
|
2000-06-26 14:44:31 +00:00
|
|
|
assignments are checked and actioned.
|
|
|
|
If no other action can be made,
|
1998-01-29 00:40:41 +00:00
|
|
|
and if
|
|
|
|
.Fl deny_incoming
|
2000-06-26 14:44:31 +00:00
|
|
|
is not specified,
|
|
|
|
the packet is delivered to the local machine and port
|
1998-01-29 00:40:41 +00:00
|
|
|
as specified in the packet.
|
2000-05-18 10:31:10 +00:00
|
|
|
.It Fl t | target_address Ar address
|
|
|
|
Set the target address.
|
|
|
|
When an incoming packet not associated with any pre-existing link
|
2000-06-26 14:44:31 +00:00
|
|
|
arrives at the host machine,
|
|
|
|
it will be sent to the specified
|
2000-05-18 10:31:10 +00:00
|
|
|
.Ar address .
|
|
|
|
.Pp
|
|
|
|
The target address may be set to
|
|
|
|
.Dq 255.255.255.255 ,
|
|
|
|
in which case all new incoming packets go to the alias address set by
|
|
|
|
.Fl alias_address
|
|
|
|
or
|
|
|
|
.Fl interface .
|
|
|
|
.Pp
|
2000-06-26 14:44:31 +00:00
|
|
|
If this option is not used,
|
|
|
|
or called with the argument
|
2000-05-22 08:41:57 +00:00
|
|
|
.Dq 0.0.0.0 ,
|
2000-06-26 14:44:31 +00:00
|
|
|
then all new incoming packets go to the address specified in the packet.
|
2000-05-18 10:31:10 +00:00
|
|
|
This allows external machines to talk directly to internal machines if
|
|
|
|
they can route packets to the machine in question.
|
1997-06-22 04:19:08 +00:00
|
|
|
.It Fl n | interface Ar interface
|
|
|
|
Use
|
|
|
|
.Ar interface
|
2000-06-26 14:44:31 +00:00
|
|
|
to determine the alias address.
|
|
|
|
If there is a possibility that the IP number associated with
|
1997-06-22 04:19:08 +00:00
|
|
|
.Ar interface
|
|
|
|
may change, the
|
|
|
|
.Fl dynamic
|
2000-06-26 14:44:31 +00:00
|
|
|
flag should also be used.
|
|
|
|
If this option is not specified, the
|
1997-06-22 04:19:08 +00:00
|
|
|
.Fl a
|
|
|
|
or
|
|
|
|
.Fl alias_address
|
|
|
|
flag must be used.
|
1998-01-29 00:40:41 +00:00
|
|
|
.Pp
|
|
|
|
The specified
|
|
|
|
.Ar interface
|
|
|
|
must be the public network interface.
|
1997-06-22 04:19:08 +00:00
|
|
|
.It Fl f | config Ar configfile
|
|
|
|
Read configuration from
|
|
|
|
.Ar configfile .
|
|
|
|
.Ar Configfile
|
2000-06-26 14:44:31 +00:00
|
|
|
contains a list of options,
|
|
|
|
one per line in the same form as the long form of the above command line flags.
|
|
|
|
For example, the line
|
|
|
|
.Pp
|
|
|
|
alias_address 158.152.17.1
|
|
|
|
.Pp
|
|
|
|
would specify an alias address of 158.152.17.1.
|
|
|
|
Options that don't take an argument are specified with an option of
|
1997-06-22 04:19:08 +00:00
|
|
|
.Ar yes
|
|
|
|
or
|
|
|
|
.Ar no
|
2000-06-26 14:44:31 +00:00
|
|
|
in the configuration file.
|
|
|
|
For example, the line
|
|
|
|
.Pp
|
|
|
|
log yes
|
|
|
|
.Pp
|
1997-06-22 04:19:08 +00:00
|
|
|
is synonomous with
|
|
|
|
.Fl log .
|
1999-09-07 15:34:12 +00:00
|
|
|
.Pp
|
|
|
|
Trailing spaces and empty lines are ignored.
|
|
|
|
A
|
|
|
|
.Ql \&#
|
1999-10-30 19:33:41 +00:00
|
|
|
sign will mark the rest of the line as a comment.
|
1999-03-07 18:23:56 +00:00
|
|
|
.It Fl reverse
|
2000-03-01 11:27:47 +00:00
|
|
|
Reverse operation of natd.
|
2000-06-26 14:44:31 +00:00
|
|
|
This can be useful in some transparent proxying situations,
|
|
|
|
when outgoing traffic is redirected to the local machine
|
|
|
|
and natd is running on the incoming interface
|
|
|
|
(it usually runs on the outgoing interface).
|
1999-03-07 18:23:56 +00:00
|
|
|
|
|
|
|
.It Fl proxy_only
|
|
|
|
Force natd to perform transparent proxying
|
2000-03-01 11:27:47 +00:00
|
|
|
only.
|
|
|
|
Normal address translation is not performed.
|
1999-03-07 18:23:56 +00:00
|
|
|
.It Fl proxy_rule Ar [type encode_ip_hdr|encode_tcp_stream] port xxxx server a.b.c.d:yyyy
|
2000-03-01 11:27:47 +00:00
|
|
|
Enable transparent proxying.
|
2000-06-26 14:44:31 +00:00
|
|
|
Packets with the given port going through this host to any other host
|
|
|
|
are redirected to the given server and port.
|
2000-03-01 11:27:47 +00:00
|
|
|
Optionally, the original target address can be encoded into the packet.
|
|
|
|
Use
|
1999-03-07 18:23:56 +00:00
|
|
|
.Dq encode_ip_hdr
|
|
|
|
to put this information into the IP option field or
|
|
|
|
.Dq encode_tcp_stream
|
|
|
|
to inject the data into the beginning of the TCP stream.
|
1997-06-22 04:19:08 +00:00
|
|
|
.El
|
|
|
|
.Sh RUNNING NATD
|
|
|
|
The following steps are necessary before attempting to run
|
|
|
|
.Nm natd :
|
|
|
|
.Bl -enum
|
|
|
|
.It
|
|
|
|
Get FreeBSD version 2.2 or higher. Versions before this do not support
|
|
|
|
.Xr divert 4
|
|
|
|
sockets.
|
|
|
|
.It
|
|
|
|
Build a custom kernel with the following options:
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
|
|
|
options IPFIREWALL
|
|
|
|
options IPDIVERT
|
|
|
|
.Pp
|
1997-06-22 04:19:08 +00:00
|
|
|
Refer to the handbook for detailed instructions on building a custom
|
|
|
|
kernel.
|
|
|
|
.It
|
2000-06-26 14:44:31 +00:00
|
|
|
Ensure that your machine is acting as a gateway.
|
|
|
|
This can be done by specifying the line
|
|
|
|
.Pp
|
|
|
|
gateway_enable=YES
|
|
|
|
.Pp
|
1997-06-22 04:19:08 +00:00
|
|
|
in
|
1997-06-22 14:40:27 +00:00
|
|
|
.Pa /etc/rc.conf ,
|
1997-06-22 04:19:08 +00:00
|
|
|
or using the command
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
|
|
|
.Nm sysctl Fl w Ar net.inet.ip.forwarding=1
|
1997-06-22 04:19:08 +00:00
|
|
|
.It
|
|
|
|
If you wish to use the
|
|
|
|
.Fl n
|
|
|
|
or
|
|
|
|
.Fl interface
|
2000-06-26 14:44:31 +00:00
|
|
|
flags,
|
|
|
|
make sure that your interface is already configured.
|
|
|
|
If, for example, you wish to specify tun0 as your
|
1997-06-22 04:19:08 +00:00
|
|
|
.Ar interface ,
|
|
|
|
and you're using
|
|
|
|
.Xr ppp 8
|
2000-06-26 14:44:31 +00:00
|
|
|
on that interface,
|
|
|
|
you must make sure that you start
|
1997-06-22 04:19:08 +00:00
|
|
|
.Nm ppp
|
|
|
|
prior to starting
|
|
|
|
.Nm natd .
|
|
|
|
.It
|
|
|
|
Create an entry in
|
|
|
|
.Pa /etc/services :
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
|
|
|
natd 8668/divert # Network Address Translation socket
|
|
|
|
.Pp
|
1997-06-22 04:19:08 +00:00
|
|
|
This gives a default for the
|
|
|
|
.Fl p
|
|
|
|
or
|
|
|
|
.Fl port
|
|
|
|
flag.
|
|
|
|
.El
|
|
|
|
.Pp
|
|
|
|
Running
|
1997-10-02 11:43:33 +00:00
|
|
|
.Nm
|
1997-06-22 04:19:08 +00:00
|
|
|
is fairly straight forward. The line
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
|
|
|
.Nm natd Fl interface Ar ed0
|
|
|
|
.Pp
|
|
|
|
should suffice in most cases
|
|
|
|
(substituting the correct interface name).
|
|
|
|
Once
|
1997-10-02 11:43:33 +00:00
|
|
|
.Nm
|
2000-06-26 14:44:31 +00:00
|
|
|
is running,
|
|
|
|
you must ensure that traffic is diverted to natd:
|
1997-06-22 04:19:08 +00:00
|
|
|
.Bl -enum
|
|
|
|
.It
|
|
|
|
You will need to adjust the
|
|
|
|
.Pa /etc/rc.firewall
|
|
|
|
script to taste. If you're not interested in having a firewall, the
|
|
|
|
following lines will do:
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
|
|
|
/sbin/ipfw -f flush
|
|
|
|
/sbin/ipfw add divert natd all from any to any via ed0
|
|
|
|
/sbin/ipfw add pass all from any to any
|
|
|
|
.Pp
|
1997-06-24 10:49:44 +00:00
|
|
|
The second line depends on your interface (change ed0 as appropriate)
|
|
|
|
and assumes that you've updated
|
1997-06-22 04:19:08 +00:00
|
|
|
.Pa /etc/services
|
2000-06-26 14:44:31 +00:00
|
|
|
with the natd entry as above.
|
|
|
|
If you specify real firewall rules,
|
|
|
|
it's best to specify line 2 at the start of the script so that
|
1997-10-02 11:43:33 +00:00
|
|
|
.Nm
|
1999-10-06 09:26:39 +00:00
|
|
|
sees all packets before they are dropped by the firewall.
|
|
|
|
.Pp
|
|
|
|
After translation by
|
1997-06-22 04:19:08 +00:00
|
|
|
.Nm natd ,
|
1999-10-06 09:26:39 +00:00
|
|
|
packets re-enter the firewall at the rule number following the rule number
|
2000-06-26 14:44:31 +00:00
|
|
|
that caused the diversion
|
|
|
|
(not the next rule if there are several at the same number).
|
1997-06-22 04:19:08 +00:00
|
|
|
.It
|
|
|
|
Enable your firewall by setting
|
2000-06-26 14:44:31 +00:00
|
|
|
.Pp
|
|
|
|
firewall_enable=YES
|
|
|
|
.Pp
|
1997-06-22 04:19:08 +00:00
|
|
|
in
|
1997-06-22 14:40:27 +00:00
|
|
|
.Pa /etc/rc.conf .
|
1997-06-22 04:19:08 +00:00
|
|
|
This tells the system startup scripts to run the
|
|
|
|
.Pa /etc/rc.firewall
|
2000-06-26 14:44:31 +00:00
|
|
|
script.
|
|
|
|
If you don't wish to reboot now, just run this by hand from the console.
|
|
|
|
NEVER run this from a virtual session unless you put it into the background.
|
|
|
|
If you do, you'll lock yourself out after the flush takes place,
|
|
|
|
and execution of
|
1997-06-22 04:19:08 +00:00
|
|
|
.Pa /etc/rc.firewall
|
2000-06-26 14:44:31 +00:00
|
|
|
will stop at this point - blocking all accesses permanently.
|
|
|
|
Running the script in the background should be enough to prevent this disaster.
|
1997-06-22 04:19:08 +00:00
|
|
|
.El
|
|
|
|
.Sh SEE ALSO
|
1997-09-29 19:11:55 +00:00
|
|
|
.Xr socket 2 ,
|
1999-08-18 01:20:07 +00:00
|
|
|
.Xr getservbyname 3 ,
|
1997-06-22 04:19:08 +00:00
|
|
|
.Xr divert 4 ,
|
|
|
|
.Xr services 5 ,
|
|
|
|
.Xr ipfw 8
|
|
|
|
.Sh AUTHORS
|
|
|
|
This program is the result of the efforts of many people at different
|
|
|
|
times:
|
1998-03-23 08:31:20 +00:00
|
|
|
.An Archie Cobbs Aq archie@whistle.com
|
|
|
|
(divert sockets)
|
2000-04-02 20:23:34 +00:00
|
|
|
.An Charles Mott Aq cmott@scientech.com
|
1998-03-23 08:31:20 +00:00
|
|
|
(packet aliasing)
|
|
|
|
.An Eivind Eklund Aq perhaps@yes.no
|
|
|
|
(IRC support & misc additions)
|
|
|
|
.An Ari Suutari Aq suutari@iki.fi
|
|
|
|
(natd)
|
1999-03-07 18:23:56 +00:00
|
|
|
.An Dru Nelson Aq dnelson@redwoodsoft.com
|
2000-06-20 12:52:27 +00:00
|
|
|
(early PPTP support)
|
1998-03-23 08:31:20 +00:00
|
|
|
.An Brian Somers Aq brian@awfulhak.org
|
|
|
|
(glue)
|