mdoc style cleanup.
Reviewed by: sheldonh
This commit is contained in:
parent
47fdd692c6
commit
27d19e4e41
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=62121
360
sbin/natd/natd.8
360
sbin/natd/natd.8
@ -47,97 +47,117 @@ Network Address Translation Daemon
|
|||||||
This program provides a Network Address Translation facility for use
|
This program provides a Network Address Translation facility for use
|
||||||
with
|
with
|
||||||
.Xr divert 4
|
.Xr divert 4
|
||||||
sockets under FreeBSD. It is intended for use with NICs - if you want
|
sockets under FreeBSD.
|
||||||
to do NAT on a PPP link, use the -nat switch to
|
It is intended for use with NICs -
|
||||||
|
if you want to do NAT on a PPP link,
|
||||||
|
use the -nat switch to
|
||||||
.Xr ppp 8 .
|
.Xr ppp 8 .
|
||||||
|
|
||||||
.Pp
|
.Pp
|
||||||
.Nm Natd
|
.Nm Natd
|
||||||
normally runs in the background as a daemon. It is passed raw IP packets
|
normally runs in the background as a daemon.
|
||||||
as they travel into and out of the machine, and will possibly change these
|
It is passed raw IP packets as they travel into and out of the machine,
|
||||||
before re-injecting them back into the IP packet stream.
|
and will possibly change these before re-injecting them back
|
||||||
|
into the IP packet stream.
|
||||||
|
|
||||||
.Pp
|
.Pp
|
||||||
.Nm Natd
|
.Nm Natd
|
||||||
changes all packets destined for another host so that their source
|
changes all packets destined for another host
|
||||||
IP number is that of the current machine. For each packet changed
|
so that their source IP number is that of the current machine.
|
||||||
in this manner, an internal table entry is created to record this
|
For each packet changed in this manner,
|
||||||
fact. The source port number is also changed to indicate the
|
an internal table entry is created to record this fact.
|
||||||
table entry applying to the packet. Packets that are received with
|
The source port number is also changed
|
||||||
a target IP of the current host are checked against this internal
|
to indicate the table entry applying to the packet.
|
||||||
table. If an entry is found, it is used to determine the correct
|
Packets that are received with a target IP of the current host
|
||||||
target IP number and port to place in the packet.
|
are checked against this internal table.
|
||||||
|
If an entry is found,
|
||||||
|
it is used to determine the correct target IP number and port
|
||||||
|
to place in the packet.
|
||||||
.Pp
|
.Pp
|
||||||
The following command line options are available.
|
The following command line options are available.
|
||||||
.Bl -tag -width Fl
|
.Bl -tag -width Fl
|
||||||
|
|
||||||
.It Fl log | l
|
.It Fl log | l
|
||||||
Log various aliasing statistics and information to the file
|
Log various aliasing statistics and information to the file
|
||||||
.Pa /var/log/alias.log .
|
.Pa /var/log/alias.log .
|
||||||
This file is truncated each time natd is started.
|
This file is truncated each time natd is started.
|
||||||
|
|
||||||
.It Fl deny_incoming | d
|
.It Fl deny_incoming | d
|
||||||
Reject packets destined for the current IP number that have no entry
|
Reject packets destined for the current IP number
|
||||||
in the internal translation table.
|
that have no entry in the internal translation table.
|
||||||
|
|
||||||
.It Fl log_denied
|
.It Fl log_denied
|
||||||
Log denied incoming packets via syslog (see also log_facility)
|
Log denied incoming packets via syslog (see also log_facility)
|
||||||
|
|
||||||
.It Fl log_facility Ar facility_name
|
.It Fl log_facility Ar facility_name
|
||||||
Use specified log facility when logging information via syslog.
|
Use specified log facility when logging information via syslog.
|
||||||
Facility names are as in
|
Facility names are as in
|
||||||
.Xr syslog.conf 5
|
.Xr syslog.conf 5
|
||||||
|
|
||||||
.It Fl use_sockets | s
|
.It Fl use_sockets | s
|
||||||
Allocate a
|
Allocate a
|
||||||
.Xr socket 2
|
.Xr socket 2
|
||||||
in order to establish an FTP data or IRC DCC send connection. This
|
in order to establish an FTP data or IRC DCC send connection.
|
||||||
option uses more system resources, but guarantees successful connections
|
This option uses more system resources,
|
||||||
when port numbers conflict.
|
but guarantees successful connections when port numbers conflict.
|
||||||
|
|
||||||
.It Fl same_ports | m
|
.It Fl same_ports | m
|
||||||
Try to keep the same port number when altering outgoing packets.
|
Try to keep the same port number when altering outgoing packets.
|
||||||
With this option, protocols such as RPC will have a better chance
|
With this option,
|
||||||
of working. If it is not possible to maintain the port number, it
|
protocols such as RPC will have a better chance of working.
|
||||||
will be silently changed as per normal.
|
If it is not possible to maintain the port number,
|
||||||
|
it will be silently changed as per normal.
|
||||||
.It Fl verbose | v
|
.It Fl verbose | v
|
||||||
Don't call
|
Don't call
|
||||||
.Xr fork 2
|
.Xr fork 2
|
||||||
or
|
or
|
||||||
.Xr daemon 3
|
.Xr daemon 3
|
||||||
on startup. Instead, stay attached to the controling terminal and
|
on startup.
|
||||||
display all packet alterations to the standard output. This option
|
Instead, stay attached to the controling terminal and
|
||||||
should only be used for debugging purposes.
|
display all packet alterations to the standard output.
|
||||||
|
This option should only be used for debugging purposes.
|
||||||
.It Fl unregistered_only | u
|
.It Fl unregistered_only | u
|
||||||
Only alter outgoing packets with an unregistered source address.
|
Only alter outgoing packets with an unregistered source address.
|
||||||
According to rfc 1918, unregistered source addresses are 10.0.0.0/8,
|
According to rfc 1918,
|
||||||
172.16.0.0/12 and 192.168.0.0/16.
|
unregistered source addresses are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
|
||||||
|
|
||||||
.It Fl redirect_port Ar proto targetIP:targetPORT[-targetPORT] [aliasIP:]aliasPORT[-aliasPORT] [remoteIP[:remotePORT[-remotePORT]]]
|
.It Fl redirect_port Ar proto targetIP:targetPORT[-targetPORT] [aliasIP:]aliasPORT[-aliasPORT] [remoteIP[:remotePORT[-remotePORT]]]
|
||||||
Redirect incoming connections arriving to given port(s) to another host
|
Redirect incoming connections arriving to given port(s) to another host
|
||||||
and port(s).
|
and port(s).
|
||||||
Proto is either tcp or udp, targetIP is the desired target IP
|
.Ar Proto
|
||||||
number, targetPORT is the desired target PORT number or range, aliasPORT
|
is either tcp or udp,
|
||||||
is the requested PORT number or range, and aliasIP is the aliasing address.
|
.Ar targetIP
|
||||||
RemoteIP and remotePORT can be used to specify the connection
|
is the desired target IP number,
|
||||||
more accurately if necessary.
|
.Ar targetPORT
|
||||||
The targetPORT range and aliasPORT range need not be the same numerically,
|
is the desired target PORT number or range,
|
||||||
|
.Ar aliasPORT
|
||||||
|
is the requested PORT number or range,
|
||||||
|
and
|
||||||
|
.Ar aliasIP
|
||||||
|
is the aliasing address.
|
||||||
|
.Ar RemoteIP
|
||||||
|
and
|
||||||
|
.Ar remotePORT
|
||||||
|
can be used to specify the connection more accurately if necessary.
|
||||||
|
The
|
||||||
|
.Ar targetPORT
|
||||||
|
range and
|
||||||
|
.Ar aliasPORT
|
||||||
|
range need not be the same numerically,
|
||||||
but must have the same size.
|
but must have the same size.
|
||||||
If remotePORT is not specified, it is assumed to be all ports.
|
If
|
||||||
If remotePORT is specified, it must match the size of targetPORT, or be 0
|
.Ar remotePORT
|
||||||
|
is not specified,
|
||||||
|
it is assumed to be all ports.
|
||||||
|
If
|
||||||
|
.Ar remotePORT
|
||||||
|
is specified,
|
||||||
|
it must match the size of targetPORT,
|
||||||
|
or be 0
|
||||||
(all ports).
|
(all ports).
|
||||||
For example, the argument
|
For example,
|
||||||
|
the argument
|
||||||
|
.Pp
|
||||||
.Dl Ar tcp inside1:telnet 6666
|
.Dl Ar tcp inside1:telnet 6666
|
||||||
|
.Pp
|
||||||
means that incoming tcp packets destined for port 6666 on this machine will
|
means that incoming tcp packets destined for port 6666 on this machine will
|
||||||
be sent to the telnet port on the inside1 machine.
|
be sent to the telnet port on the inside1 machine.
|
||||||
|
.Pp
|
||||||
.Dl Ar tcp inside2:2300-2399 3300-3399
|
.Dl Ar tcp inside2:2300-2399 3300-3399
|
||||||
|
.Pp
|
||||||
will redirect incoming connections on ports 3300-3399 to host
|
will redirect incoming connections on ports 3300-3399 to host
|
||||||
inside2, ports 2300-2399.
|
inside2, ports 2300-2399.
|
||||||
The mapping is 1:1 meaning port 3300 maps to 2300, 3301 maps to 2301, etc.
|
The mapping is 1:1 meaning port 3300 maps to 2300, 3301 maps to 2301, etc.
|
||||||
@ -155,34 +175,34 @@ address and vice versa.
|
|||||||
.Pp
|
.Pp
|
||||||
If
|
If
|
||||||
.Ar publicIP
|
.Ar publicIP
|
||||||
is not specified, then the default aliasing address is used.
|
is not specified,
|
||||||
|
then the default aliasing address is used.
|
||||||
If
|
If
|
||||||
.Ar remoteIP
|
.Ar remoteIP
|
||||||
is specified, then only packets coming from/to
|
is specified,
|
||||||
|
then only packets coming from/to
|
||||||
.Ar remoteIP
|
.Ar remoteIP
|
||||||
will match the rule.
|
will match the rule.
|
||||||
.It Fl redirect_address Ar localIP publicIP
|
.It Fl redirect_address Ar localIP publicIP
|
||||||
Redirect traffic for public IP address to a machine on the local
|
Redirect traffic for public IP address to a machine on the local network.
|
||||||
network.
|
This function is known as "static NAT".
|
||||||
This function is known as "static NAT". Normally static NAT
|
Normally static NAT is useful
|
||||||
is useful if your ISP has allocated a small block of IP addresses to you,
|
if your ISP has allocated a small block of IP addresses to you,
|
||||||
but it can even be used in the case of single address:
|
but it can even be used in the case of single address:
|
||||||
|
.Pp
|
||||||
redirect_address 10.0.0.8 0.0.0.0
|
.Dl Ar redirect_address 10.0.0.8 0.0.0.0
|
||||||
|
.Pp
|
||||||
The above command would redirect all incoming traffic
|
The above command would redirect all incoming traffic to machine 10.0.0.8.
|
||||||
to machine 10.0.0.8.
|
.Pp
|
||||||
|
If several address aliases specify the same public address as follows
|
||||||
If several address aliases specify the same public address
|
.Pp
|
||||||
as follows
|
.Dl Ar redirect_address 192.168.0.2 public_addr
|
||||||
|
.Dl Ar redirect_address 192.168.0.3 public_addr
|
||||||
redirect_address 192.168.0.2 public_addr
|
.Dl Ar redirect_address 192.168.0.4 public_addr
|
||||||
redirect_address 192.168.0.3 public_addr
|
.Pp
|
||||||
redirect_address 192.168.0.4 public_addr
|
|
||||||
|
|
||||||
the incoming traffic will be directed to the last
|
the incoming traffic will be directed to the last
|
||||||
translated local address (192.168.0.4), but outgoing
|
translated local address (192.168.0.4),
|
||||||
traffic to the first two addresses will still be aliased
|
but outgoing traffic to the first two addresses will still be aliased
|
||||||
to specified public address.
|
to specified public address.
|
||||||
.It Fl redirect_port Ar proto Xo
|
.It Fl redirect_port Ar proto Xo
|
||||||
.Ar targetIP Ns : Ns Xo
|
.Ar targetIP Ns : Ns Xo
|
||||||
@ -216,13 +236,15 @@ distribute the load across a pool of servers.
|
|||||||
This function is known as
|
This function is known as
|
||||||
.Em LSNAT
|
.Em LSNAT
|
||||||
(RFC 2391).
|
(RFC 2391).
|
||||||
For example, the argument
|
For example,
|
||||||
|
the argument
|
||||||
.Pp
|
.Pp
|
||||||
.Dl Ar tcp www1:http,www2:http,www3:http www:http
|
.Dl Ar tcp www1:http,www2:http,www3:http www:http
|
||||||
.Pp
|
.Pp
|
||||||
means that incoming HTTP requests for host www will be transparently
|
means that incoming HTTP requests for host www will be transparently
|
||||||
redirected to one of the www1, www2 or www3, where a host is selected
|
redirected to one of the www1, www2 or www3,
|
||||||
simply on a round-robin basis, without regard to load on the net.
|
where a host is selected simply on a round-robin basis,
|
||||||
|
without regard to load on the net.
|
||||||
.It Fl dynamic
|
.It Fl dynamic
|
||||||
If the
|
If the
|
||||||
.Fl n
|
.Fl n
|
||||||
@ -232,20 +254,18 @@ option is used,
|
|||||||
.Nm
|
.Nm
|
||||||
will monitor the routing socket for alterations to the
|
will monitor the routing socket for alterations to the
|
||||||
.Ar interface
|
.Ar interface
|
||||||
passed. If the interfaces IP number is changed,
|
passed.
|
||||||
|
If the interfaces IP number is changed,
|
||||||
.Nm
|
.Nm
|
||||||
will dynamically alter its concept of the alias address.
|
will dynamically alter its concept of the alias address.
|
||||||
|
|
||||||
.It Fl i | inport Ar inport
|
.It Fl i | inport Ar inport
|
||||||
Read from and write to
|
Read from and write to
|
||||||
.Ar inport ,
|
.Ar inport ,
|
||||||
treating all packets as packets coming into the machine.
|
treating all packets as packets coming into the machine.
|
||||||
|
|
||||||
.It Fl o | outport Ar outport
|
.It Fl o | outport Ar outport
|
||||||
Read from and write to
|
Read from and write to
|
||||||
.Ar outport ,
|
.Ar outport ,
|
||||||
treating all packets as packets going out of the machine.
|
treating all packets as packets going out of the machine.
|
||||||
|
|
||||||
.It Fl p | port Ar port
|
.It Fl p | port Ar port
|
||||||
Read from and write to
|
Read from and write to
|
||||||
.Ar port ,
|
.Ar port ,
|
||||||
@ -257,45 +277,54 @@ is not numeric, it is searched for in the
|
|||||||
.Pa /etc/services
|
.Pa /etc/services
|
||||||
database using the
|
database using the
|
||||||
.Xr getservbyname 3
|
.Xr getservbyname 3
|
||||||
function. If this flag is not specified, the divert port named natd will
|
function.
|
||||||
be used as a default. An example entry in the
|
If this flag is not specified,
|
||||||
|
the divert port named natd will be used as a default.
|
||||||
|
An example entry in the
|
||||||
.Pa /etc/services
|
.Pa /etc/services
|
||||||
database would be:
|
database would be:
|
||||||
|
.Pp
|
||||||
natd 8668/divert # Network Address Translation socket
|
natd 8668/divert # Network Address Translation socket
|
||||||
|
.Pp
|
||||||
Refer to
|
Refer to
|
||||||
.Xr services 5
|
.Xr services 5
|
||||||
for further details.
|
for further details.
|
||||||
|
|
||||||
.It Fl a | alias_address Ar address
|
.It Fl a | alias_address Ar address
|
||||||
Use
|
Use
|
||||||
.Ar address
|
.Ar address
|
||||||
as the alias address. If this option is not specified, the
|
as the alias address.
|
||||||
|
If this option is not specified, the
|
||||||
.Fl n
|
.Fl n
|
||||||
or
|
or
|
||||||
.Fl interface
|
.Fl interface
|
||||||
option must be used. The specified address should be the address assigned
|
option must be used.
|
||||||
|
The specified address should be the address assigned
|
||||||
to the public network interface.
|
to the public network interface.
|
||||||
.Pp
|
.Pp
|
||||||
All data passing out through this addresses interface will be rewritten
|
All data passing out through this addresses interface will be rewritten
|
||||||
with a source address equal to
|
with a source address equal to
|
||||||
.Ar address .
|
.Ar address .
|
||||||
All data arriving at the interface from outside will be checked to
|
All data arriving at the interface from outside will be checked to
|
||||||
see if it matches any already-aliased outgoing connection. If it does,
|
see if it matches any already-aliased outgoing connection.
|
||||||
the packet is altered accordingly. If not, all
|
If it does,
|
||||||
|
the packet is altered accordingly.
|
||||||
|
If not,
|
||||||
|
all
|
||||||
.Fl redirect_port
|
.Fl redirect_port
|
||||||
and
|
and
|
||||||
.Fl redirect_address
|
.Fl redirect_address
|
||||||
assignments are checked and actioned. If no other action can be made,
|
assignments are checked and actioned.
|
||||||
|
If no other action can be made,
|
||||||
and if
|
and if
|
||||||
.Fl deny_incoming
|
.Fl deny_incoming
|
||||||
is not specified, the packet is delivered to the local machine and port
|
is not specified,
|
||||||
|
the packet is delivered to the local machine and port
|
||||||
as specified in the packet.
|
as specified in the packet.
|
||||||
.It Fl t | target_address Ar address
|
.It Fl t | target_address Ar address
|
||||||
Set the target address.
|
Set the target address.
|
||||||
When an incoming packet not associated with any pre-existing link
|
When an incoming packet not associated with any pre-existing link
|
||||||
arrives at the host machine, it will be sent to the specified
|
arrives at the host machine,
|
||||||
|
it will be sent to the specified
|
||||||
.Ar address .
|
.Ar address .
|
||||||
.Pp
|
.Pp
|
||||||
The target address may be set to
|
The target address may be set to
|
||||||
@ -305,21 +334,22 @@ in which case all new incoming packets go to the alias address set by
|
|||||||
or
|
or
|
||||||
.Fl interface .
|
.Fl interface .
|
||||||
.Pp
|
.Pp
|
||||||
If this option is not used, or called with the argument
|
If this option is not used,
|
||||||
|
or called with the argument
|
||||||
.Dq 0.0.0.0 ,
|
.Dq 0.0.0.0 ,
|
||||||
then all new incoming packets go to the address specified in
|
then all new incoming packets go to the address specified in the packet.
|
||||||
the packet.
|
|
||||||
This allows external machines to talk directly to internal machines if
|
This allows external machines to talk directly to internal machines if
|
||||||
they can route packets to the machine in question.
|
they can route packets to the machine in question.
|
||||||
.It Fl n | interface Ar interface
|
.It Fl n | interface Ar interface
|
||||||
Use
|
Use
|
||||||
.Ar interface
|
.Ar interface
|
||||||
to determine the alias address. If there is a possibility that the
|
to determine the alias address.
|
||||||
IP number associated with
|
If there is a possibility that the IP number associated with
|
||||||
.Ar interface
|
.Ar interface
|
||||||
may change, the
|
may change, the
|
||||||
.Fl dynamic
|
.Fl dynamic
|
||||||
flag should also be used. If this option is not specified, the
|
flag should also be used.
|
||||||
|
If this option is not specified, the
|
||||||
.Fl a
|
.Fl a
|
||||||
or
|
or
|
||||||
.Fl alias_address
|
.Fl alias_address
|
||||||
@ -332,20 +362,22 @@ must be the public network interface.
|
|||||||
Read configuration from
|
Read configuration from
|
||||||
.Ar configfile .
|
.Ar configfile .
|
||||||
.Ar Configfile
|
.Ar Configfile
|
||||||
contains a list of options, one per line in the same form as the
|
contains a list of options,
|
||||||
long form of the above command line flags. For example, the line
|
one per line in the same form as the long form of the above command line flags.
|
||||||
|
For example, the line
|
||||||
alias_address 158.152.17.1
|
.Pp
|
||||||
|
alias_address 158.152.17.1
|
||||||
would specify an alias address of 158.152.17.1. Options that don't
|
.Pp
|
||||||
take an argument are specified with an option of
|
would specify an alias address of 158.152.17.1.
|
||||||
|
Options that don't take an argument are specified with an option of
|
||||||
.Ar yes
|
.Ar yes
|
||||||
or
|
or
|
||||||
.Ar no
|
.Ar no
|
||||||
in the configuration file. For example, the line
|
in the configuration file.
|
||||||
|
For example, the line
|
||||||
log yes
|
.Pp
|
||||||
|
log yes
|
||||||
|
.Pp
|
||||||
is synonomous with
|
is synonomous with
|
||||||
.Fl log .
|
.Fl log .
|
||||||
.Pp
|
.Pp
|
||||||
@ -353,23 +385,21 @@ Trailing spaces and empty lines are ignored.
|
|||||||
A
|
A
|
||||||
.Ql \&#
|
.Ql \&#
|
||||||
sign will mark the rest of the line as a comment.
|
sign will mark the rest of the line as a comment.
|
||||||
|
|
||||||
.It Fl reverse
|
.It Fl reverse
|
||||||
Reverse operation of natd.
|
Reverse operation of natd.
|
||||||
This can be useful in some
|
This can be useful in some transparent proxying situations,
|
||||||
transparent proxying situations when outgoing traffic
|
when outgoing traffic is redirected to the local machine
|
||||||
is redirected to the local machine and natd is running on the
|
and natd is running on the incoming interface
|
||||||
incoming interface (it usually runs on the outgoing interface).
|
(it usually runs on the outgoing interface).
|
||||||
|
|
||||||
.It Fl proxy_only
|
.It Fl proxy_only
|
||||||
Force natd to perform transparent proxying
|
Force natd to perform transparent proxying
|
||||||
only.
|
only.
|
||||||
Normal address translation is not performed.
|
Normal address translation is not performed.
|
||||||
|
|
||||||
.It Fl proxy_rule Ar [type encode_ip_hdr|encode_tcp_stream] port xxxx server a.b.c.d:yyyy
|
.It Fl proxy_rule Ar [type encode_ip_hdr|encode_tcp_stream] port xxxx server a.b.c.d:yyyy
|
||||||
Enable transparent proxying.
|
Enable transparent proxying.
|
||||||
Packets with the given port going through this
|
Packets with the given port going through this host to any other host
|
||||||
host to any other host are redirected to the given server and port.
|
are redirected to the given server and port.
|
||||||
Optionally, the original target address can be encoded into the packet.
|
Optionally, the original target address can be encoded into the packet.
|
||||||
Use
|
Use
|
||||||
.Dq encode_ip_hdr
|
.Dq encode_ip_hdr
|
||||||
@ -377,132 +407,126 @@ to put this information into the IP option field or
|
|||||||
.Dq encode_tcp_stream
|
.Dq encode_tcp_stream
|
||||||
to inject the data into the beginning of the TCP stream.
|
to inject the data into the beginning of the TCP stream.
|
||||||
.El
|
.El
|
||||||
|
|
||||||
.Sh RUNNING NATD
|
.Sh RUNNING NATD
|
||||||
The following steps are necessary before attempting to run
|
The following steps are necessary before attempting to run
|
||||||
.Nm natd :
|
.Nm natd :
|
||||||
|
|
||||||
.Bl -enum
|
.Bl -enum
|
||||||
.It
|
.It
|
||||||
Get FreeBSD version 2.2 or higher. Versions before this do not support
|
Get FreeBSD version 2.2 or higher. Versions before this do not support
|
||||||
.Xr divert 4
|
.Xr divert 4
|
||||||
sockets.
|
sockets.
|
||||||
|
|
||||||
.It
|
.It
|
||||||
Build a custom kernel with the following options:
|
Build a custom kernel with the following options:
|
||||||
|
.Pp
|
||||||
options IPFIREWALL
|
options IPFIREWALL
|
||||||
options IPDIVERT
|
options IPDIVERT
|
||||||
|
.Pp
|
||||||
Refer to the handbook for detailed instructions on building a custom
|
Refer to the handbook for detailed instructions on building a custom
|
||||||
kernel.
|
kernel.
|
||||||
|
|
||||||
.It
|
.It
|
||||||
Ensure that your machine is acting as a gateway. This can be done by
|
Ensure that your machine is acting as a gateway.
|
||||||
specifying the line
|
This can be done by specifying the line
|
||||||
|
.Pp
|
||||||
gateway_enable=YES
|
gateway_enable=YES
|
||||||
|
.Pp
|
||||||
in
|
in
|
||||||
.Pa /etc/rc.conf ,
|
.Pa /etc/rc.conf ,
|
||||||
or using the command
|
or using the command
|
||||||
|
.Pp
|
||||||
sysctl -w net.inet.ip.forwarding=1
|
.Nm sysctl Fl w Ar net.inet.ip.forwarding=1
|
||||||
|
|
||||||
.It
|
.It
|
||||||
If you wish to use the
|
If you wish to use the
|
||||||
.Fl n
|
.Fl n
|
||||||
or
|
or
|
||||||
.Fl interface
|
.Fl interface
|
||||||
flags, make sure that your interface is already configured. If, for
|
flags,
|
||||||
example, you wish to specify tun0 as your
|
make sure that your interface is already configured.
|
||||||
|
If, for example, you wish to specify tun0 as your
|
||||||
.Ar interface ,
|
.Ar interface ,
|
||||||
and you're using
|
and you're using
|
||||||
.Xr ppp 8
|
.Xr ppp 8
|
||||||
on that interface, you must make sure that you start
|
on that interface,
|
||||||
|
you must make sure that you start
|
||||||
.Nm ppp
|
.Nm ppp
|
||||||
prior to starting
|
prior to starting
|
||||||
.Nm natd .
|
.Nm natd .
|
||||||
|
|
||||||
.It
|
.It
|
||||||
Create an entry in
|
Create an entry in
|
||||||
.Pa /etc/services :
|
.Pa /etc/services :
|
||||||
|
.Pp
|
||||||
natd 8668/divert # Network Address Translation socket
|
natd 8668/divert # Network Address Translation socket
|
||||||
|
.Pp
|
||||||
This gives a default for the
|
This gives a default for the
|
||||||
.Fl p
|
.Fl p
|
||||||
or
|
or
|
||||||
.Fl port
|
.Fl port
|
||||||
flag.
|
flag.
|
||||||
|
|
||||||
.El
|
.El
|
||||||
.Pp
|
.Pp
|
||||||
Running
|
Running
|
||||||
.Nm
|
.Nm
|
||||||
is fairly straight forward. The line
|
is fairly straight forward. The line
|
||||||
|
.Pp
|
||||||
natd -interface ed0
|
.Nm natd Fl interface Ar ed0
|
||||||
|
.Pp
|
||||||
should suffice in most cases (substituting the correct interface name). Once
|
should suffice in most cases
|
||||||
|
(substituting the correct interface name).
|
||||||
|
Once
|
||||||
.Nm
|
.Nm
|
||||||
is running, you must ensure that traffic is diverted to natd:
|
is running,
|
||||||
|
you must ensure that traffic is diverted to natd:
|
||||||
.Bl -enum
|
.Bl -enum
|
||||||
.It
|
.It
|
||||||
You will need to adjust the
|
You will need to adjust the
|
||||||
.Pa /etc/rc.firewall
|
.Pa /etc/rc.firewall
|
||||||
script to taste. If you're not interested in having a firewall, the
|
script to taste. If you're not interested in having a firewall, the
|
||||||
following lines will do:
|
following lines will do:
|
||||||
|
.Pp
|
||||||
/sbin/ipfw -f flush
|
/sbin/ipfw -f flush
|
||||||
/sbin/ipfw add divert natd all from any to any via ed0
|
/sbin/ipfw add divert natd all from any to any via ed0
|
||||||
/sbin/ipfw add pass all from any to any
|
/sbin/ipfw add pass all from any to any
|
||||||
|
.Pp
|
||||||
The second line depends on your interface (change ed0 as appropriate)
|
The second line depends on your interface (change ed0 as appropriate)
|
||||||
and assumes that you've updated
|
and assumes that you've updated
|
||||||
.Pa /etc/services
|
.Pa /etc/services
|
||||||
with the natd entry as above. If you specify real firewall rules, it's
|
with the natd entry as above.
|
||||||
best to specify line 2 at the start of the script so that
|
If you specify real firewall rules,
|
||||||
|
it's best to specify line 2 at the start of the script so that
|
||||||
.Nm
|
.Nm
|
||||||
sees all packets before they are dropped by the firewall.
|
sees all packets before they are dropped by the firewall.
|
||||||
.Pp
|
.Pp
|
||||||
After translation by
|
After translation by
|
||||||
.Nm natd ,
|
.Nm natd ,
|
||||||
packets re-enter the firewall at the rule number following the rule number
|
packets re-enter the firewall at the rule number following the rule number
|
||||||
that caused the diversion (not the next rule if there are several at the
|
that caused the diversion
|
||||||
same number).
|
(not the next rule if there are several at the same number).
|
||||||
|
|
||||||
.It
|
.It
|
||||||
Enable your firewall by setting
|
Enable your firewall by setting
|
||||||
|
.Pp
|
||||||
firewall_enable=YES
|
firewall_enable=YES
|
||||||
|
.Pp
|
||||||
in
|
in
|
||||||
.Pa /etc/rc.conf .
|
.Pa /etc/rc.conf .
|
||||||
This tells the system startup scripts to run the
|
This tells the system startup scripts to run the
|
||||||
.Pa /etc/rc.firewall
|
.Pa /etc/rc.firewall
|
||||||
script. If you don't wish to reboot now, just run this by hand from the
|
script.
|
||||||
console. NEVER run this from a virtual session unless you put it into
|
If you don't wish to reboot now, just run this by hand from the console.
|
||||||
the background. If you do, you'll lock yourself out after the flush
|
NEVER run this from a virtual session unless you put it into the background.
|
||||||
takes place, and execution of
|
If you do, you'll lock yourself out after the flush takes place,
|
||||||
|
and execution of
|
||||||
.Pa /etc/rc.firewall
|
.Pa /etc/rc.firewall
|
||||||
will stop at this point - blocking all accesses permanently. Running
|
will stop at this point - blocking all accesses permanently.
|
||||||
the script in the background should be enough to prevent this disaster.
|
Running the script in the background should be enough to prevent this disaster.
|
||||||
|
|
||||||
.El
|
.El
|
||||||
|
|
||||||
.Sh SEE ALSO
|
.Sh SEE ALSO
|
||||||
.Xr socket 2 ,
|
.Xr socket 2 ,
|
||||||
.Xr getservbyname 3 ,
|
.Xr getservbyname 3 ,
|
||||||
.Xr divert 4 ,
|
.Xr divert 4 ,
|
||||||
.Xr services 5 ,
|
.Xr services 5 ,
|
||||||
.Xr ipfw 8
|
.Xr ipfw 8
|
||||||
|
|
||||||
.Sh AUTHORS
|
.Sh AUTHORS
|
||||||
This program is the result of the efforts of many people at different
|
This program is the result of the efforts of many people at different
|
||||||
times:
|
times:
|
||||||
|
|
||||||
.An Archie Cobbs Aq archie@whistle.com
|
.An Archie Cobbs Aq archie@whistle.com
|
||||||
(divert sockets)
|
(divert sockets)
|
||||||
.An Charles Mott Aq cmott@scientech.com
|
.An Charles Mott Aq cmott@scientech.com
|
||||||
|
Loading…
Reference in New Issue
Block a user