1.\" manual page [] for natd 1.4 2.\" $FreeBSD$ 3.Dd 15 April 1997 4.Os FreeBSD 5.Dt NATD 8 6.Sh NAME 7.Nm natd 8.Nd 9Network Address Translation Daemon 10.Sh SYNOPSIS 11.Nm 12.Op Fl ldsmvu 13.Op Fl dynamic 14.Op Fl i Ar inport 15.Op Fl o Ar outport 16.Op Fl p Ar port 17.Op Fl a Ar address 18.Op Fl n Ar interface 19.Op Fl f Ar configfile 20 21.Nm 22.Op Fl log 23.Op Fl deny_incoming 24.Op Fl log_denied 25.Op Fl use_sockets 26.Op Fl same_ports 27.Op Fl verbose 28.Op Fl log_facility Ar facility_name 29.Op Fl unregistered_only 30.Op Fl dynamic 31.Op Fl inport Ar inport 32.Op Fl outport Ar outport 33.Op Fl port Ar port 34.Op Fl alias_address Ar address 35.Op Fl interface Ar interface 36.Op Fl config Ar configfile 37.Op Fl redirect_port Ar linkspec 38.Op Fl redirect_address Ar localIP publicIP 39.Op Fl reverse 40.Op Fl proxy_only 41.Op Fl proxy_rule Ar proxyspec 42.Op Fl pptpalias Ar localIP 43 44.Sh DESCRIPTION 45This program provides a Network Address Translation facility for use 46with 47.Xr divert 4 48sockets under FreeBSD. It is intended for use with NICs - if you want 49to do NAT on a PPP link, use the -alias switch to 50.Xr ppp 8 . 51 52.Pp 53.Nm Natd 54normally runs in the background as a daemon. It is passed raw IP packets 55as they travel into and out of the machine, and will possibly change these 56before re-injecting them back into the IP packet stream. 57 58.Pp 59.Nm Natd 60changes all packets destined for another host so that their source 61IP number is that of the current machine. For each packet changed 62in this manner, an internal table entry is created to record this 63fact. The source port number is also changed to indicate the 64table entry applying to the packet. Packets that are received with 65a target IP of the current host are checked against this internal 66table. If an entry is found, it is used to determine the correct 67target IP number and port to place in the packet. 68 69.Pp 70The following command line options are available. 71.Bl -tag -width Fl 72 73.It Fl log | l 74Log various aliasing statistics and information to the file 75.Pa /var/log/alias.log . 76This file is truncated each time natd is started. 77 78.It Fl deny_incoming | d 79Reject packets destined for the current IP number that have no entry 80in the internal translation table. 81 82.It Fl log_denied 83Log denied incoming packets via syslog (see also log_facility) 84 85.It Fl log_facility Ar facility_name 86Use specified log facility when logging information via syslog. 87Facility names are as in 88.Xr syslog.conf 5 89 90.It Fl use_sockets | s 91Allocate a 92.Xr socket 2 93in order to establish an FTP data or IRC DCC send connection. This 94option uses more system resources, but guarantees successful connections 95when port numbers conflict. 96 97.It Fl same_ports | m 98Try to keep the same port number when altering outgoing packets. 99With this option, protocols such as RPC will have a better chance 100of working. If it is not possible to maintain the port number, it 101will be silently changed as per normal. 102 103.It Fl verbose | v 104Don't call 105.Xr fork 2 106or 107.Xr daemon 3 108on startup. Instead, stay attached to the controling terminal and 109display all packet alterations to the standard output. This option 110should only be used for debugging purposes. 111 112.It Fl unregistered_only | u 113Only alter outgoing packets with an unregistered source address. 114According to rfc 1918, unregistered source addresses are 10.0.0.0/8, 115172.16.0.0/12 and 192.168.0.0/16. 116 117.It Fl redirect_port Ar proto targetIP:targetPORT[-targetPORT] [aliasIP:]aliasPORT[-aliasPORT] [remoteIP[:remotePORT[-remotePORT]]] 118Redirect incoming connections arriving to given port(s) to another host 119and port(s). 120Proto is either tcp or udp, targetIP is the desired target IP 121number, targetPORT is the desired target PORT number or range, aliasPORT 122is the requested PORT number or range, and aliasIP is the aliasing address. 123RemoteIP and remotePORT can be used to specify the connection 124more accurately if necessary. 125The targetPORT range and aliasPORT range need not be the same numerically, 126but must have the same size. 127If remotePORT is not specified, it is assumed to be all ports. 128If remotePORT is specified, it must match the size of targetPORT, or be 0 129(all ports). 130For example, the argument 131 132.Dl Ar tcp inside1:telnet 6666 133 134means that incoming tcp packets destined for port 6666 on this machine will 135be sent to the telnet port on the inside1 machine. 136 137.Dl Ar tcp inside2:2300-2399 3300-3399 138 139will redirect incoming connections on ports 3300-3399 to host 140inside2, ports 2300-2399. 141The mapping is 1:1 meaning port 3300 maps to 2300, 3301 maps to 2301, etc. 142 143.It Fl redirect_address Ar localIP publicIP 144Redirect traffic for public IP address to a machine on the local 145network. This function is known as "static NAT". Normally static NAT 146is useful if your ISP has allocated a small block of IP addresses to you, 147but it can even be used in the case of single address: 148 149 redirect_address 10.0.0.8 0.0.0.0 150 151The above command would redirect all incoming traffic 152to machine 10.0.0.8. 153 154If several address aliases specify the same public address 155as follows 156 157 redirect_address 192.168.0.2 public_addr 158 redirect_address 192.168.0.3 public_addr 159 redirect_address 192.168.0.4 public_addr 160 161the incoming traffic will be directed to the last 162translated local address (192.168.0.4), but outgoing 163traffic to the first two addresses will still be aliased 164to specified public address. 165 166.It Fl dynamic 167If the 168.Fl n 169or 170.Fl interface 171option is used, 172.Nm 173will monitor the routing socket for alterations to the 174.Ar interface 175passed. If the interfaces IP number is changed, 176.Nm 177will dynamically alter its concept of the alias address. 178 179.It Fl i | inport Ar inport 180Read from and write to 181.Ar inport , 182treating all packets as packets coming into the machine. 183 184.It Fl o | outport Ar outport 185Read from and write to 186.Ar outport , 187treating all packets as packets going out of the machine. 188 189.It Fl p | port Ar port 190Read from and write to 191.Ar port , 192distinguishing packets as incoming our outgoing using the rules specified in 193.Xr divert 4 . 194If 195.Ar port 196is not numeric, it is searched for in the 197.Pa /etc/services 198database using the 199.Xr getservbyname 3 200function. If this flag is not specified, the divert port named natd will 201be used as a default. An example entry in the 202.Pa /etc/services 203database would be: 204 205 natd 8668/divert # Network Address Translation socket 206 207Refer to 208.Xr services 5 209for further details. 210 211.It Fl a | alias_address Ar address 212Use 213.Ar address 214as the alias address. If this option is not specified, the 215.Fl n 216or 217.Fl interface 218option must be used. The specified address should be the address assigned 219to the public network interface. 220.Pp 221All data passing out through this addresses interface will be rewritten 222with a source address equal to 223.Ar address . 224All data arriving at the interface from outside will be checked to 225see if it matches any already-aliased outgoing connection. If it does, 226the packet is altered accordingly. If not, all 227.Fl redirect_port 228and 229.Fl redirect_address 230assignments are checked and actioned. If no other action can be made, 231and if 232.Fl deny_incoming 233is not specified, the packet is delivered to the local machine and port 234as specified in the packet. 235 236.It Fl n | interface Ar interface 237Use 238.Ar interface 239to determine the alias address. If there is a possibility that the 240IP number associated with 241.Ar interface 242may change, the 243.Fl dynamic 244flag should also be used. If this option is not specified, the 245.Fl a 246or 247.Fl alias_address 248flag must be used. 249.Pp 250The specified 251.Ar interface 252must be the public network interface. 253.It Fl f | config Ar configfile 254Read configuration from 255.Ar configfile . 256.Ar Configfile 257contains a list of options, one per line in the same form as the 258long form of the above command line flags. For example, the line 259 260 alias_address 158.152.17.1 261 262would specify an alias address of 158.152.17.1. Options that don't 263take an argument are specified with an option of 264.Ar yes 265or 266.Ar no 267in the configuration file. For example, the line 268 269 log yes 270 271is synonomous with 272.Fl log . 273Empty lines and lines beginning with '#' are ignored. 274 275.It Fl reverse 276Reverse operation of natd. This can be useful in some 277transparent proxying situations when outgoing traffic 278is redirected to the local machine and natd is running on the 279incoming interface (it usually runs on the outgoing interface). 280 281.It Fl proxy_only 282Force natd to perform transparent proxying 283only. Normal address translation is not performed. 284 285.It Fl proxy_rule Ar [type encode_ip_hdr|encode_tcp_stream] port xxxx server a.b.c.d:yyyy 286Enable transparent proxying. Packets with the given port going through this 287host to any other host are redirected to the given server and port. 288Optionally, the original target address can be encoded into the packet. Use 289.Dq encode_ip_hdr 290to put this information into the IP option field or 291.Dq encode_tcp_stream 292to inject the data into the beginning of the TCP stream. 293 294.It Fl pptpalias Ar localIP 295Allow PPTP packets to go to the defined localIP address. PPTP is a VPN or secure 296IP tunneling technology being developed primarily by Microsoft. For its encrypted traffic, 297it uses an old IP encapsulation protocol called GRE (47). This 298natd option will translate any traffic of this protocol to a 299single, specified IP address. This would allow either one client or one server 300to be serviced with natd. If you are setting up a server, don't forget to allow the TCP traffic 301for the PPTP setup. For a client or server, you must allow GRE (protocol 47) if you have firewall lists active. 302 303.El 304 305.Sh RUNNING NATD 306The following steps are necessary before attempting to run 307.Nm natd : 308 309.Bl -enum 310.It 311Get FreeBSD version 2.2 or higher. Versions before this do not support 312.Xr divert 4 313sockets. 314 315.It 316Build a custom kernel with the following options: 317 318 options IPFIREWALL 319 options IPDIVERT 320 321Refer to the handbook for detailed instructions on building a custom 322kernel. 323 324.It 325Ensure that your machine is acting as a gateway. This can be done by 326specifying the line 327 328 gateway_enable=YES 329 330in 331.Pa /etc/rc.conf , 332or using the command 333 334 sysctl -w net.inet.ip.forwarding=1 335 336.It 337If you wish to use the 338.Fl n 339or 340.Fl interface 341flags, make sure that your interface is already configured. If, for 342example, you wish to specify tun0 as your 343.Ar interface , 344and you're using 345.Xr ppp 8 346on that interface, you must make sure that you start 347.Nm ppp 348prior to starting 349.Nm natd . 350 351.It 352Create an entry in 353.Pa /etc/services : 354 355 natd 8668/divert # Network Address Translation socket 356 357This gives a default for the 358.Fl p 359or 360.Fl port 361flag. 362 363.El 364.Pp 365Running 366.Nm 367is fairly straight forward. The line 368 369 natd -interface ed0 370 371should suffice in most cases (substituting the correct interface name). Once 372.Nm 373is running, you must ensure that traffic is diverted to natd: 374 375.Bl -enum 376.It 377You will need to adjust the 378.Pa /etc/rc.firewall 379script to taste. If you're not interested in having a firewall, the 380following lines will do: 381 382 /sbin/ipfw -f flush 383 /sbin/ipfw add divert natd all from any to any via ed0 384 /sbin/ipfw add pass all from any to any 385 386The second line depends on your interface (change ed0 as appropriate) 387and assumes that you've updated 388.Pa /etc/services 389with the natd entry as above. If you specify real firewall rules, it's 390best to specify line 2 at the start of the script so that 391.Nm 392sees all packets before they are dropped by the firewall. The firewall 393rules will be run again on each packet after translation by 394.Nm natd , 395minus any divert rules. 396 397.It 398Enable your firewall by setting 399 400 firewall_enable=YES 401 402in 403.Pa /etc/rc.conf . 404This tells the system startup scripts to run the 405.Pa /etc/rc.firewall 406script. If you don't wish to reboot now, just run this by hand from the 407console. NEVER run this from a virtual session unless you put it into 408the background. If you do, you'll lock yourself out after the flush 409takes place, and execution of 410.Pa /etc/rc.firewall 411will stop at this point - blocking all accesses permanently. Running 412the script in the background should be enough to prevent this disaster. 413 414.El 415 416.Sh SEE ALSO 417.Xr socket 2 , 418.Xr getservbyname 3 , 419.Xr divert 4 , 420.Xr services 5 , 421.Xr ipfw 8 422 423.Sh AUTHORS 424This program is the result of the efforts of many people at different 425times: 426 427.An Archie Cobbs Aq archie@whistle.com 428(divert sockets) 429.An Charles Mott Aq cmott@srv.net 430(packet aliasing) 431.An Eivind Eklund Aq perhaps@yes.no 432(IRC support & misc additions) 433.An Ari Suutari Aq suutari@iki.fi 434(natd) 435.An Dru Nelson Aq dnelson@redwoodsoft.com 436(PPTP support) 437.An Brian Somers Aq brian@awfulhak.org 438(glue) 439