natd(8)
NAME
natd - Network Address Translation daemon
SYNOPSIS
natd [-unregistered_only | -u] [-log | -l] [-proxy_only]
[-reverse]
[-deny_incoming | -d] [-use_sockets | -s] [-same_ports
| -m]
[-verbose | -v] [-dynamic] [-in_port | -i port]
[-out_port | -o port] [-port | -p port]
[-alias_address | -a address] [-target_address | -t
address]
[-interface | -n interface] [-proxy_rule proxyspec]
[-redirect_port linkspec] [-redirect_proto linkspec]
[-redirect_address linkspec] [-config | -f configfile]
[-log_denied]
[-log_facility facility_name] [-punch_fw
firewall_range]
[-skinny_port port] [-log_ipfw_denied] [-pid_file | -P
pidfile]
DESCRIPTION
- The natd utility provides a Network Address Translation fa
- cility for use
with divert(4) sockets under FreeBSD. - (If you need NAT on a PPP link, ppp(8) provides the -nat op
- tion that
gives most of the natd functionality, and uses the same - libalias(3)
library.) - The natd utility normally runs in the background as a dae
- mon. It is
passed raw IP packets as they travel into and out of the ma - chine, and
will possibly change these before re-injecting them back in - to the IP
packet stream. - It changes all packets destined for another host so that
- their source IP
address is that of the current machine. For each packet - changed in this
manner, an internal table entry is created to record this - fact. The
source port number is also changed to indicate the table en - try applying
to the packet. Packets that are received with a target IP - of the current
host are checked against this internal table. If an entry - is found, it
is used to determine the correct target IP address and port - to place in
the packet. - The following command line options are available:
- -log | -l Log various aliasing statistics and information
- to the file
- /var/log/alias.log. This file is truncated each
- time natd is
started. - -deny_incoming | -d
- Do not pass incoming packets that have no entry
- in the internal translation table.
- If this option is not used, then such a packet
- will be
altered using the rules in -target_address be - low, and the
entry will be made in the internal translation - table.
- -log_denied
- Log denied incoming packets via syslog(3) (see
- also
-log_facility). - -log_facility facility_name
- Use specified log facility when logging informa
- tion via
syslog(3). Argument facility_name is one of the - keywords
specified in syslog.conf(5). - -use_sockets | -s
- Allocate a socket(2) in order to establish an
- FTP data or IRC
DCC send connection. This option uses more sys - tem resources,
but guarantees successful connections when port - numbers conflict.
- -same_ports | -m
- Try to keep the same port number when altering
- outgoing packets. With this option, protocols such as RPC
- will have a
better chance of working. If it is not possible - to maintain
the port number, it will be silently changed as - per normal.
- -verbose | -v
- Do not call daemon(3) on startup. Instead, stay
- attached to
the controlling terminal and display all packet - alterations
to the standard output. This option should only - be used for
debugging purposes. - -unregistered_only | -u
- Only alter outgoing packets with an unregistered
- source
address. According to RFC 1918, unregistered - source
addresses are 10.0.0.0/8, 172.16.0.0/12 and - 192.168.0.0/16.
- -redirect_port proto targetIP:targetPORT[-targetPORT]
- [aliasIP:]aliasPORT[-aliasPORT] [remoteIP[:remotePORT[-remotePORT]]] Redirect incoming connections arriving to given
- port(s) to
another host and port(s). Argument proto is ei - ther tcp or
udp, targetIP is the desired target IP address, - targetPORT is
the desired target port number or range, - aliasPORT is the
requested port number or range, and aliasIP is - the aliasing
address. Arguments remoteIP and remotePORT can - be used to
specify the connection more accurately if neces - sary. If
remotePORT is not specified, it is assumed to be - all ports.
- Arguments targetIP, aliasIP and remoteIP can be
- given as IP
addresses or as hostnames. The targetPORT, - aliasPORT and
remotePORT ranges need not be the same numeri - cally, but must
have the same size. When targetPORT, aliasPORT - or remotePORT
specifies a singular value (not a range), it can - be given as
a service name that is searched for in the ser - vices(5)
database. - For example, the argument
tcp inside1:telnet 6666 - means that incoming TCP packets destined for
- port 6666 on
this machine will be sent to the telnet port on - the inside1
machine.
tcp inside2:2300-2399 3300-3399 - will redirect incoming connections on ports
- 3300-3399 to host
inside2, ports 2300-2399. The mapping is 1:1 - meaning port
3300 maps to 2300, 3301 maps to 2301, etc. - -redirect_proto proto localIP [publicIP [remoteIP]]
- Redirect incoming IP packets of protocol proto
- (see
protocols(5)) destined for publicIP address to a - localIP
address and vice versa. - If publicIP is not specified, then the default
- aliasing
address is used. If remoteIP is specified, then - only packets
coming from/to remoteIP will match the rule. - -redirect_address localIP publicIP
- Redirect traffic for public IP address to a ma
- chine on the
local network. This function is known as static - NAT. Normally static NAT is useful if your ISP has allo
- cated a small
block of IP addresses to you, but it can even be - used in the
case of single address:
redirect_address 10.0.0.8 0.0.0.0 - The above command would redirect all incoming
- traffic to
machine 10.0.0.8. - If several address aliases specify the same pub
- lic address as
follows
redirect_address 192.168.0.2 public_addr
redirect_address 192.168.0.3 public_addr
redirect_address 192.168.0.4 public_addr - the incoming traffic will be directed to the
- last translated
local address (192.168.0.4), but outgoing traf - fic from the
first two addresses will still be aliased to ap - pear from the
specified public_addr. - -redirect_port proto
- targetIP:targetPORT[,targetIP:targetPORT[,...]]
- [aliasIP:]aliasPORT [remoteIP[:remotePORT]]
- -redirect_address localIP[,localIP[,...]] publicIP
- These forms of -redirect_port and
- -redirect_address are used
to transparently offload network load on a sin - gle server and
distribute the load across a pool of servers. - This function
is known as LSNAT (RFC 2391). For example, the - argument
tcp www1:http,www2:http,www3:http www:http - means that incoming HTTP requests for host www
- will be transparently redirected to one of the www1, www2 or
- www3, where a
host is selected simply on a round-robin basis, - without
regard to load on the net. - -dynamic If the -n or -interface option is used, natd
- will monitor the
- routing socket for alterations to the interface
- passed. If
the interface's IP address is changed, natd will - dynamically
alter its concept of the alias address. - -in_port | -i port
- Read from and write to divert(4) port port,
- treating all
packets as ``incoming''. - -out_port | -o port
- Read from and write to divert(4) port port,
- treating all
packets as ``outgoing''. - -port | -p port
- Read from and write to divert(4) port port, dis
- tinguishing
packets as ``incoming'' or ``outgoing'' using - the rules specified in divert(4). If port is not numeric, it
- is searched
for in the services(5) database. If this option - is not specified, the divert port named natd will be used
- as a default.
- -alias_address | -a address
- Use address as the aliasing address. Either
- this or the
-interface option must be used (but not both), - if the
-proxy_only option is not specified. The speci - fied address
is usually the address assigned to the ``pub - lic'' network
interface. - All data passing out will be rewritten with a
- source address
equal to address. All data coming in will be - checked to see
if it matches any already-aliased outgoing con - nection. If it
does, the packet is altered accordingly. If - not, all
-redirect_port, -redirect_proto and - -redirect_address assignments are checked and actioned. If no other ac
- tion can be
made and if -deny_incoming is not specified, the - packet is
delivered to the local machine using the rules - specified in
-target_address option below. - -t | -target_address address
- Set the target address. When an incoming packet
- not associated with any pre-existing link arrives at the
- host machine,
it will be sent to the specified address. - The target address may be set to
- 255.255.255.255, in which
case all new incoming packets go to the alias - address set by
-alias_address or -interface. - If this option is not used, or called with the
- argument
0.0.0.0, then all new incoming packets go to the - address
specified in the packet. This allows external - machines to
talk directly to internal machines if they can - route packets
to the machine in question. - -interface | -n interface
- Use interface to determine the aliasing address.
- If there is
a possibility that the IP address associated - with interface
may change, the -dynamic option should also be - used. If this
option is not specified, the -alias_address op - tion must be
used. - The specified interface is usually the ``pub
- lic'' (or
``external'') network interface. - -config | -f file
- Read configuration from file. A file should
- contain a list
of options, one per line, in the same form as - the long form
of the above command line options. For example, - the line
alias_address 158.152.17.1 - would specify an alias address of 158.152.17.1.
- Options that
do not take an argument are specified with an - argument of yes
or no in the configuration file. For example, - the line
log yes - is synonymous with -log.
- Trailing spaces and empty lines are ignored. A
- `#' sign will
mark the rest of the line as a comment. - -reverse This option makes natd reverse the way it han
- dles
- ``incoming'' and ``outgoing'' packets, allowing
- it to operate
on the ``internal'' network interface rather - than the
``external'' one. - This can be useful in some transparent proxying
- situations
when outgoing traffic is redirected to the local - machine and
natd is running on the internal interface (it - usually runs on
the external interface). - -proxy_only
- Force natd to perform transparent proxying only.
- Normal
address translation is not performed. - -proxy_rule [type encode_ip_hdr | encode_tcp_stream] port
- xxxx server
- a.b.c.d:yyyy
Enable transparent proxying. Outgoing TCP pack - ets with the
given port going through this host to any other - host are
redirected to the given server and port. Op - tionally, the
original target address can be encoded into the - packet. Use
encode_ip_hdr to put this information into the - IP option
field or encode_tcp_stream to inject the data - into the beginning of the TCP stream.
- -punch_fw basenumber:count
- This option directs natd to ``punch holes'' in
- an
ipfirewall(4) based firewall for FTP/IRC DCC - connections.
This is done dynamically by installing temporary - firewall
rules which allow a particular connection (and - only that connection) to go through the firewall. The rules
- are removed
once the corresponding connection terminates. - A maximum of count rules starting from the rule
- number
basenumber will be used for punching firewall - holes. The
range will be cleared for all rules on startup. - -skinny_port port
- This option allows you to specify the TCP port
- used for the
Skinny Station protocol. Skinny is used by Cis - co IP phones
to communicate with Cisco Call Managers to set - up voice over
IP calls. By default, Skinny aliasing is not - performed. The
typical port value for Skinny is 2000. - -log_ipfw_denied
- Log when a packet cannot be re-injected because
- an ipfw(8)
rule blocks it. This is the default with - -verbose.
- -pid_file | -P file
- Specify an alternate file in which to store the
- process ID.
The default is /var/run/natd.pid.
RUNNING NATD
- The following steps are necessary before attempting to run
- natd:
- 1. Build a custom kernel with the following options:
options IPFIREWALL
options IPDIVERT- Refer to the handbook for detailed instructions on
- building a custom
kernel. - 2. Ensure that your machine is acting as a gateway. This
- can be done
by specifying the line
gateway_enable=YES- in the /etc/rc.conf file or using the command
sysctl net.inet.ip.forwarding=1- 3. If you use the -interface option, make sure that your
- interface isalready configured. If, for example, you wish to spec
- ify `tun0' as
your interface, and you are using ppp(8) on that inter - face, you must
make sure that you start ppp prior to starting natd. - Running natd is fairly straight forward. The line
natd -interface ed0- should suffice in most cases (substituting the correct in
- terface name).
Please check rc.conf(5) on how to configure it to be started - automatically during boot. Once natd is running, you must ensure
- that traffic is
diverted to natd: - 1. You will need to adjust the /etc/rc.firewall script to
- taste. Ifyou are not interested in having a firewall, the fol
- lowing lines
will do:
/sbin/ipfw -f flush
/sbin/ipfw add divert natd all from any to any- via ed0
/sbin/ipfw add pass all from any to any - The second line depends on your interface (change `ed0'
- as appropriate).
- You should be aware of the fact that, with these fire
- wall settings,
everyone on your local network can fake his source-ad - dress using
your host as gateway. If there are other hosts on your - local network, you are strongly encouraged to create firewall
- rules that only
allow traffic to and from trusted hosts. - If you specify real firewall rules, it is best to spec
- ify line 2 at
the start of the script so that natd sees all packets - before they
are dropped by the firewall. - After translation by natd, packets re-enter the fire
- wall at the rule
number following the rule number that caused the diver - sion (not the
next rule if there are several at the same number). - 2. Enable your firewall by setting
firewall_enable=YES- in /etc/rc.conf. This tells the system startup scripts
- to run the
/etc/rc.firewall script. If you do not wish to reboot - now, just run
this by hand from the console. NEVER run this from a - remote session
unless you put it into the background. If you do, you - will lock
yourself out after the flush takes place, and execution - of
/etc/rc.firewall will stop at this point - blocking all - accesses
permanently. Running the script in the background - should be enough
to prevent this disaster.
SEE ALSO
AUTHORS
- This program is the result of the efforts of many people at
- different
times: - Archie Cobbs <archie@FreeBSD.org> (divert sockets)
Charles Mott <cm@linktel.net> (packet aliasing)
Eivind Eklund <perhaps@yes.no> (IRC support & misc addi - tions)
Ari Suutari <suutari@iki.fi> (natd)
Dru Nelson <dnelson@redwoodsoft.com> (early PPTP support)
Brian Somers <brian@awfulhak.org> (glue)
Ruslan Ermilov <ru@FreeBSD.org> (natd, packet aliasing, - glue)
- BSD February 28, 2003