1.\" $FreeBSD$ 2.Dd June 27, 2000 3.Dt NATD 8 4.Os 5.Sh NAME 6.Nm natd 7.Nd Network Address Translation daemon 8.Sh SYNOPSIS 9.Nm 10.Bk -words 11.Op Fl unregistered_only | u 12.Op Fl log | l 13.Op Fl proxy_only 14.Op Fl reverse 15.Op Fl deny_incoming | d 16.Op Fl use_sockets | s 17.Op Fl same_ports | m 18.Op Fl verbose | v 19.Op Fl dynamic 20.Op Fl in_port | i Ar port 21.Op Fl out_port | o Ar port 22.Op Fl port | p Ar port 23.Op Fl alias_address | a Ar address 24.Op Fl target_address | t Ar address 25.Op Fl interface | n Ar interface 26.Op Fl proxy_rule Ar proxyspec 27.Op Fl redirect_port Ar linkspec 28.Op Fl redirect_proto Ar linkspec 29.Op Fl redirect_address Ar linkspec 30.Op Fl config | f Ar configfile 31.Op Fl log_denied 32.Op Fl log_facility Ar facility_name 33.Op Fl punch_fw Ar firewall_range 34.Op Fl log_ipfw_denied 35.Ek 36.Sh DESCRIPTION 37This program provides a Network Address Translation facility for use 38with 39.Xr divert 4 40sockets under 41.Fx . 42It is intended for use with NICs - if you want to do NAT on a PPP link, 43use the 44.Fl nat 45switch to 46.Xr ppp 8 . 47.Pp 48The 49.Nm 50normally runs in the background as a daemon. 51It is passed raw IP packets as they travel into and out of the machine, 52and will possibly change these before re-injecting them back into the 53IP packet stream. 54.Pp 55It changes all packets destined for another host so that their source 56IP number is that of the current machine. 57For each packet changed in this manner, an internal table entry is 58created to record this fact. 59The source port number is also changed to indicate the table entry 60applying to the packet. 61Packets that are received with a target IP of the current host are 62checked against this internal table. 63If an entry is found, it is used to determine the correct target IP 64number and port to place in the packet. 65.Pp 66The following command line options are available: 67.Bl -tag -width Fl 68.It Fl log | l 69Log various aliasing statistics and information to the file 70.Pa /var/log/alias.log . 71This file is truncated each time 72.Nm 73is started. 74.It Fl deny_incoming | d 75Do not pass incoming packets that have no 76entry in the internal translation table. 77.Pp 78If this option is not used, then such a packet will be altered 79using the rules in 80.Fl target_address 81below, and the entry will be made in the internal translation table. 82.It Fl log_denied 83Log denied incoming packets via 84.Xr syslog 3 85(see also 86.Fl log_facility ) . 87.It Fl log_facility Ar facility_name 88Use specified log facility when logging information via 89.Xr syslog 3 . 90Argument 91.Ar facility_name 92is one of the keywords specified in 93.Xr syslog.conf 5 . 94.It Fl use_sockets | s 95Allocate a 96.Xr socket 2 97in order to establish an FTP data or IRC DCC send connection. 98This option uses more system resources, but guarantees successful 99connections when port numbers conflict. 100.It Fl same_ports | m 101Try to keep the same port number when altering outgoing packets. 102With this option, protocols such as RPC will have a better chance 103of working. 104If it is not possible to maintain the port number, it will be silently 105changed as per normal. 106.It Fl verbose | v 107Do not call 108.Xr daemon 3 109on startup. 110Instead, stay attached to the controlling terminal and display all packet 111alterations to the standard output. 112This option should only be used for debugging purposes. 113.It Fl unregistered_only | u 114Only alter outgoing packets with an 115.Em unregistered 116source address. 117According to RFC 1918, unregistered source addresses are 10.0.0.0/8, 118172.16.0.0/12 and 192.168.0.0/16. 119.It Fl redirect_port Ar proto Xo 120.Ar targetIP Ns : Ns Xo 121.Ar targetPORT Ns Op - Ns Ar targetPORT Xc 122.Op Ar aliasIP Ns : Ns Xo 123.Ar aliasPORT Ns Op - Ns Ar aliasPORT Xc 124.Oo Ar remoteIP Ns Oo : Ns 125.Ar remotePORT Ns Op - Ns Ar remotePORT 126.Oc Oc 127.Xc 128Redirect incoming connections arriving to given port(s) to another host 129and port(s). 130Argument 131.Ar proto 132is either 133.Ar tcp 134or 135.Ar udp , 136.Ar targetIP 137is the desired target IP number, 138.Ar targetPORT 139is the desired target port number or range, 140.Ar aliasPORT 141is the requested port number or range, and 142.Ar aliasIP 143is the aliasing address. 144Arguments 145.Ar remoteIP 146and 147.Ar remotePORT 148can be used to specify the connection more accurately if necessary. 149The 150.Ar targetPORT 151range and 152.Ar aliasPORT 153range need not be the same numerically, but must have the same size. 154If 155.Ar remotePORT 156is not specified, it is assumed to be all ports. 157If 158.Ar remotePORT 159is specified, it must match the size of 160.Ar targetPORT , 161or be 0 (all ports). 162For example, the argument 163.Pp 164.Dl Ar tcp inside1:telnet 6666 165.Pp 166means that incoming TCP packets destined for port 6666 on this machine 167will be sent to the telnet port on the inside1 machine. 168.Pp 169.Dl Ar tcp inside2:2300-2399 3300-3399 170.Pp 171will redirect incoming connections on ports 3300-3399 to host 172inside2, ports 2300-2399. 173The mapping is 1:1 meaning port 3300 maps to 2300, 3301 maps to 2301, etc. 174.It Fl redirect_proto Ar proto localIP Oo 175.Ar publicIP Op Ar remoteIP 176.Oc 177Redirect incoming IP packets of protocol 178.Ar proto 179(see 180.Xr protocols 5 ) 181destined for 182.Ar publicIP 183address to a 184.Ar localIP 185address and vice versa. 186.Pp 187If 188.Ar publicIP 189is not specified, then the default aliasing address is used. 190If 191.Ar remoteIP 192is specified, then only packets coming from/to 193.Ar remoteIP 194will match the rule. 195.It Fl redirect_address Ar localIP publicIP 196Redirect traffic for public IP address to a machine on the local 197network. 198This function is known as 199.Em static NAT . 200Normally static NAT is useful if your ISP has allocated a small block 201of IP addresses to you, but it can even be used in the case of single 202address: 203.Pp 204.Dl Ar redirect_address 10.0.0.8 0.0.0.0 205.Pp 206The above command would redirect all incoming traffic 207to machine 10.0.0.8. 208.Pp 209If several address aliases specify the same public address 210as follows 211.Bd -literal -offset indent 212.Ar redirect_address 192.168.0.2 public_addr 213.Ar redirect_address 192.168.0.3 public_addr 214.Ar redirect_address 192.168.0.4 public_addr 215.Ed 216.Pp 217the incoming traffic will be directed to the last 218translated local address (192.168.0.4), but outgoing 219traffic from the first two addresses will still be aliased 220to appear from the specified 221.Ar public_addr . 222.It Fl redirect_port Ar proto Xo 223.Ar targetIP Ns : Ns Xo 224.Ar targetPORT Ns Oo , Ns 225.Ar targetIP Ns : Ns Xo 226.Ar targetPORT Ns Oo , Ns 227.Ar ...\& 228.Oc Oc 229.Xc 230.Xc 231.Op Ar aliasIP Ns : Ns Xo 232.Ar aliasPORT 233.Xc 234.Oo Ar remoteIP Ns 235.Op : Ns Ar remotePORT 236.Oc 237.Xc 238.It Fl redirect_address Xo 239.Ar localIP Ns Oo , Ns 240.Ar localIP Ns Oo , Ns 241.Ar ...\& 242.Oc Oc 243.Ar publicIP 244.Xc 245These forms of 246.Fl redirect_port 247and 248.Fl redirect_address 249are used to transparently offload network load on a single server and 250distribute the load across a pool of servers. 251This function is known as 252.Em LSNAT 253(RFC 2391). 254For example, the argument 255.Pp 256.Dl Ar tcp www1:http,www2:http,www3:http www:http 257.Pp 258means that incoming HTTP requests for host www will be transparently 259redirected to one of the www1, www2 or www3, where a host is selected 260simply on a round-robin basis, without regard to load on the net. 261.It Fl dynamic 262If the 263.Fl n 264or 265.Fl interface 266option is used, 267.Nm 268will monitor the routing socket for alterations to the 269.Ar interface 270passed. 271If the interface's IP number is changed, 272.Nm 273will dynamically alter its concept of the alias address. 274.It Fl in_port | i Ar port 275Read from and write to 276.Xr divert 4 277port 278.Ar port , 279treating all packets as 280.Dq incoming . 281.It Fl out_port | o Ar port 282Read from and write to 283.Xr divert 4 284port 285.Ar port , 286treating all packets as 287.Dq outgoing . 288.It Fl port | p Ar port 289Read from and write to 290.Xr divert 4 291port 292.Ar port , 293distinguishing packets as 294.Dq incoming 295or 296.Dq outgoing 297using the rules specified in 298.Xr divert 4 . 299If 300.Ar port 301is not numeric, it is searched for in the 302.Xr services 5 303database. 304If this option is not specified, the divert port named 305.Ar natd 306will be used as a default. 307.It Fl alias_address | a Ar address 308Use 309.Ar address 310as the aliasing address. 311If this option is not specified, the 312.Fl interface 313option must be used. 314The specified address is usually the address assigned to the 315.Dq public 316network interface. 317.Pp 318All data passing 319.Em out 320will be rewritten with a source address equal to 321.Ar address . 322All data coming 323.Em in 324will be checked to see if it matches any already-aliased outgoing 325connection. 326If it does, the packet is altered accordingly. 327If not, all 328.Fl redirect_port , 329.Fl redirect_proto 330and 331.Fl redirect_address 332assignments are checked and actioned. 333If no other action can be made and if 334.Fl deny_incoming 335is not specified, the packet is delivered to the local machine 336using the rules specified in 337.Fl target_address 338option below. 339.It Fl t | target_address Ar address 340Set the target address. 341When an incoming packet not associated with any pre-existing link 342arrives at the host machine, it will be sent to the specified 343.Ar address . 344.Pp 345The target address may be set to 346.Ar 255.255.255.255 , 347in which case all new incoming packets go to the alias address set by 348.Fl alias_address 349or 350.Fl interface . 351.Pp 352If this option is not used, or called with the argument 353.Ar 0.0.0.0 , 354then all new incoming packets go to the address specified in 355the packet. 356This allows external machines to talk directly to internal machines if 357they can route packets to the machine in question. 358.It Fl interface | n Ar interface 359Use 360.Ar interface 361to determine the aliasing address. 362If there is a possibility that the IP number associated with 363.Ar interface 364may change, the 365.Fl dynamic 366option should also be used. 367If this option is not specified, the 368.Fl alias_address 369option must be used. 370.Pp 371The specified 372.Ar interface 373is usually the 374.Dq public 375(or 376.Dq external ) 377network interface. 378.It Fl config | f Ar file 379Read configuration from 380.Ar file . 381A 382.Ar file 383should contain a list of options, one per line, in the same form 384as the long form of the above command line options. 385For example, the line 386.Pp 387.Dl alias_address 158.152.17.1 388.Pp 389would specify an alias address of 158.152.17.1. 390Options that do not take an argument are specified with an argument of 391.Ar yes 392or 393.Ar no 394in the configuration file. 395For example, the line 396.Pp 397.Dl log yes 398.Pp 399is synonymous with 400.Fl log . 401.Pp 402Trailing spaces and empty lines are ignored. 403A 404.Ql \&# 405sign will mark the rest of the line as a comment. 406.It Fl reverse 407This option makes 408.Nm 409reverse the way it handles 410.Dq incoming 411and 412.Dq outgoing 413packets, allowing it to operate on the 414.Dq internal 415network interface rather than the 416.Dq external 417one. 418.Pp 419This can be useful in some transparent proxying situations 420when outgoing traffic is redirected to the local machine 421and 422.Nm 423is running on the internal interface (it usually runs on the 424external interface). 425.It Fl proxy_only 426Force 427.Nm 428to perform transparent proxying only. 429Normal address translation is not performed. 430.It Fl proxy_rule Xo 431.Op Ar type encode_ip_hdr | encode_tcp_stream 432.Ar port xxxx 433.Ar server a.b.c.d:yyyy 434.Xc 435Enable transparent proxying. 436Outgoing TCP packets with the given port going through this 437host to any other host are redirected to the given server and port. 438Optionally, the original target address can be encoded into the packet. 439Use 440.Ar encode_ip_hdr 441to put this information into the IP option field or 442.Ar encode_tcp_stream 443to inject the data into the beginning of the TCP stream. 444.It Fl punch_fw Xo 445.Ar basenumber Ns : Ns Ar count 446.Xc 447This option directs 448.Nm 449to 450.Dq punch holes 451in an 452.Xr ipfirewall 4 453based firewall for FTP/IRC DCC connections. 454This is done dynamically by installing temporary firewall rules which 455allow a particular connection (and only that connection) to go through 456the firewall. 457The rules are removed once the corresponding connection terminates. 458.Pp 459A maximum of 460.Ar count 461rules starting from the rule number 462.Ar basenumber 463will be used for punching firewall holes. 464The range will be cleared for all rules on startup. 465.It Fl log_ipfw_denied 466Log when a packet can not be re-injected because an 467.Xr ipfw 8 468rule blocks it. 469This is the default with 470.Fl verbose . 471.El 472.Sh RUNNING NATD 473The following steps are necessary before attempting to run 474.Nm : 475.Bl -enum 476.It 477Build a custom kernel with the following options: 478.Bd -literal -offset indent 479options IPFIREWALL 480options IPDIVERT 481.Ed 482.Pp 483Refer to the handbook for detailed instructions on building a custom 484kernel. 485.It 486Ensure that your machine is acting as a gateway. 487This can be done by specifying the line 488.Pp 489.Dl gateway_enable=YES 490.Pp 491in the 492.Pa /etc/rc.conf 493file or using the command 494.Pp 495.Dl "sysctl net.inet.ip.forwarding=1" 496.Pp 497.It 498If you use the 499.Fl interface 500option, make sure that your interface is already configured. 501If, for example, you wish to specify 502.Ql tun0 503as your 504.Ar interface , 505and you are using 506.Xr ppp 8 507on that interface, you must make sure that you start 508.Nm ppp 509prior to starting 510.Nm . 511.El 512.Pp 513Running 514.Nm 515is fairly straight forward. 516The line 517.Pp 518.Dl natd -interface ed0 519.Pp 520should suffice in most cases (substituting the correct interface name). 521Please check 522.Xr rc.conf 5 523on how to configure it to be started automatically during boot. 524Once 525.Nm 526is running, you must ensure that traffic is diverted to 527.Nm : 528.Bl -enum 529.It 530You will need to adjust the 531.Pa /etc/rc.firewall 532script to taste. 533If you are not interested in having a firewall, the 534following lines will do: 535.Bd -literal -offset indent 536/sbin/ipfw -f flush 537/sbin/ipfw add divert natd all from any to any via ed0 538/sbin/ipfw add pass all from any to any 539.Ed 540.Pp 541The second line depends on your interface (change 542.Ql ed0 543as appropriate). 544.Pp 545You should be aware of the fact that, with these firewall settings, 546everyone on your local network can fake his source-address using your 547host as gateway. 548If there are other hosts on your local network, you are strongly 549encouraged to create firewall rules that only allow traffic to and 550from trusted hosts. 551.Pp 552If you specify real firewall rules, it is best to specify line 2 at 553the start of the script so that 554.Nm 555sees all packets before they are dropped by the firewall. 556.Pp 557After translation by 558.Nm , 559packets re-enter the firewall at the rule number following the rule number 560that caused the diversion (not the next rule if there are several at the 561same number). 562.It 563Enable your firewall by setting 564.Pp 565.Dl firewall_enable=YES 566.Pp 567in 568.Pa /etc/rc.conf . 569This tells the system startup scripts to run the 570.Pa /etc/rc.firewall 571script. 572If you do not wish to reboot now, just run this by hand from the console. 573NEVER run this from a remote session unless you put it into the background. 574If you do, you will lock yourself out after the flush takes place, and 575execution of 576.Pa /etc/rc.firewall 577will stop at this point - blocking all accesses permanently. 578Running the script in the background should be enough to prevent this 579disaster. 580.El 581.Sh SEE ALSO 582.Xr divert 4 , 583.Xr protocols 5 , 584.Xr rc.conf 5 , 585.Xr services 5 , 586.Xr syslog.conf 5 , 587.Xr ipfw 8 , 588.Xr ppp 8 589.Sh AUTHORS 590This program is the result of the efforts of many people at different 591times: 592.Pp 593.An Archie Cobbs Aq archie@whistle.com 594(divert sockets) 595.An Charles Mott Aq cmott@scientech.com 596(packet aliasing) 597.An Eivind Eklund Aq perhaps@yes.no 598(IRC support & misc additions) 599.An Ari Suutari Aq suutari@iki.fi 600(natd) 601.An Dru Nelson Aq dnelson@redwoodsoft.com 602(early PPTP support) 603.An Brian Somers Aq brian@awfulhak.org 604(glue) 605.An Ruslan Ermilov Aq ru@FreeBSD.org 606(natd, packet aliasing, glue) 607