1.\" $FreeBSD$ 2.Dd February 28, 2003 3.Dt NATD 8 4.Os 5.Sh NAME 6.Nm natd 7.Nd Network Address Translation daemon 8.Sh SYNOPSIS 9.Nm 10.Bk -words 11.Op Fl unregistered_only | u 12.Op Fl log | l 13.Op Fl proxy_only 14.Op Fl reverse 15.Op Fl deny_incoming | d 16.Op Fl use_sockets | s 17.Op Fl same_ports | m 18.Op Fl verbose | v 19.Op Fl dynamic 20.Op Fl in_port | i Ar port 21.Op Fl out_port | o Ar port 22.Op Fl port | p Ar port 23.Op Fl alias_address | a Ar address 24.Op Fl target_address | t Ar address 25.Op Fl interface | n Ar interface 26.Op Fl proxy_rule Ar proxyspec 27.Op Fl redirect_port Ar linkspec 28.Op Fl redirect_proto Ar linkspec 29.Op Fl redirect_address Ar linkspec 30.Op Fl config | f Ar configfile 31.Op Fl log_denied 32.Op Fl log_facility Ar facility_name 33.Op Fl punch_fw Ar firewall_range 34.Op Fl log_ipfw_denied 35.Ek 36.Sh DESCRIPTION 37The 38.Nm 39utility provides a Network Address Translation facility for use 40with 41.Xr divert 4 42sockets under 43.Fx . 44.Pp 45(If you need NAT on a PPP link, 46.Xr ppp 8 47provides the 48.Fl nat 49option that gives most of the 50.Nm 51functionality, and uses the same 52.Xr libalias 3 53library.) 54.Pp 55The 56.Nm 57utility normally runs in the background as a daemon. 58It is passed raw IP packets as they travel into and out of the machine, 59and will possibly change these before re-injecting them back into the 60IP packet stream. 61.Pp 62It changes all packets destined for another host so that their source 63IP number is that of the current machine. 64For each packet changed in this manner, an internal table entry is 65created to record this fact. 66The source port number is also changed to indicate the table entry 67applying to the packet. 68Packets that are received with a target IP of the current host are 69checked against this internal table. 70If an entry is found, it is used to determine the correct target IP 71number and port to place in the packet. 72.Pp 73The following command line options are available: 74.Bl -tag -width Fl 75.It Fl log | l 76Log various aliasing statistics and information to the file 77.Pa /var/log/alias.log . 78This file is truncated each time 79.Nm 80is started. 81.It Fl deny_incoming | d 82Do not pass incoming packets that have no 83entry in the internal translation table. 84.Pp 85If this option is not used, then such a packet will be altered 86using the rules in 87.Fl target_address 88below, and the entry will be made in the internal translation table. 89.It Fl log_denied 90Log denied incoming packets via 91.Xr syslog 3 92(see also 93.Fl log_facility ) . 94.It Fl log_facility Ar facility_name 95Use specified log facility when logging information via 96.Xr syslog 3 . 97Argument 98.Ar facility_name 99is one of the keywords specified in 100.Xr syslog.conf 5 . 101.It Fl use_sockets | s 102Allocate a 103.Xr socket 2 104in order to establish an FTP data or IRC DCC send connection. 105This option uses more system resources, but guarantees successful 106connections when port numbers conflict. 107.It Fl same_ports | m 108Try to keep the same port number when altering outgoing packets. 109With this option, protocols such as RPC will have a better chance 110of working. 111If it is not possible to maintain the port number, it will be silently 112changed as per normal. 113.It Fl verbose | v 114Do not call 115.Xr daemon 3 116on startup. 117Instead, stay attached to the controlling terminal and display all packet 118alterations to the standard output. 119This option should only be used for debugging purposes. 120.It Fl unregistered_only | u 121Only alter outgoing packets with an 122.Em unregistered 123source address. 124According to RFC 1918, unregistered source addresses are 10.0.0.0/8, 125172.16.0.0/12 and 192.168.0.0/16. 126.It Fl redirect_port Ar proto Xo 127.Ar targetIP Ns : Ns Xo 128.Ar targetPORT Ns Op - Ns Ar targetPORT Xc 129.Op Ar aliasIP Ns : Ns Xo 130.Ar aliasPORT Ns Op - Ns Ar aliasPORT Xc 131.Oo Ar remoteIP Ns Oo : Ns 132.Ar remotePORT Ns Op - Ns Ar remotePORT 133.Oc Oc 134.Xc 135Redirect incoming connections arriving to given port(s) to another host 136and port(s). 137Argument 138.Ar proto 139is either 140.Ar tcp 141or 142.Ar udp , 143.Ar targetIP 144is the desired target IP number, 145.Ar targetPORT 146is the desired target port number or range, 147.Ar aliasPORT 148is the requested port number or range, and 149.Ar aliasIP 150is the aliasing address. 151Arguments 152.Ar remoteIP 153and 154.Ar remotePORT 155can be used to specify the connection more accurately if necessary. 156The 157.Ar targetPORT 158range and 159.Ar aliasPORT 160range need not be the same numerically, but must have the same size. 161If 162.Ar remotePORT 163is not specified, it is assumed to be all ports. 164If 165.Ar remotePORT 166is specified, it must match the size of 167.Ar targetPORT , 168or be 0 (all ports). 169For example, the argument 170.Pp 171.Dl Ar tcp inside1:telnet 6666 172.Pp 173means that incoming TCP packets destined for port 6666 on this machine 174will be sent to the telnet port on the inside1 machine. 175.Pp 176.Dl Ar tcp inside2:2300-2399 3300-3399 177.Pp 178will redirect incoming connections on ports 3300-3399 to host 179inside2, ports 2300-2399. 180The mapping is 1:1 meaning port 3300 maps to 2300, 3301 maps to 2301, etc. 181.It Fl redirect_proto Ar proto localIP Oo 182.Ar publicIP Op Ar remoteIP 183.Oc 184Redirect incoming IP packets of protocol 185.Ar proto 186(see 187.Xr protocols 5 ) 188destined for 189.Ar publicIP 190address to a 191.Ar localIP 192address and vice versa. 193.Pp 194If 195.Ar publicIP 196is not specified, then the default aliasing address is used. 197If 198.Ar remoteIP 199is specified, then only packets coming from/to 200.Ar remoteIP 201will match the rule. 202.It Fl redirect_address Ar localIP publicIP 203Redirect traffic for public IP address to a machine on the local 204network. 205This function is known as 206.Em static NAT . 207Normally static NAT is useful if your ISP has allocated a small block 208of IP addresses to you, but it can even be used in the case of single 209address: 210.Pp 211.Dl Ar redirect_address 10.0.0.8 0.0.0.0 212.Pp 213The above command would redirect all incoming traffic 214to machine 10.0.0.8. 215.Pp 216If several address aliases specify the same public address 217as follows 218.Bd -literal -offset indent 219.Ar redirect_address 192.168.0.2 public_addr 220.Ar redirect_address 192.168.0.3 public_addr 221.Ar redirect_address 192.168.0.4 public_addr 222.Ed 223.Pp 224the incoming traffic will be directed to the last 225translated local address (192.168.0.4), but outgoing 226traffic from the first two addresses will still be aliased 227to appear from the specified 228.Ar public_addr . 229.It Fl redirect_port Ar proto Xo 230.Ar targetIP Ns : Ns Xo 231.Ar targetPORT Ns Oo , Ns 232.Ar targetIP Ns : Ns Xo 233.Ar targetPORT Ns Oo , Ns 234.Ar ...\& 235.Oc Oc 236.Xc 237.Xc 238.Op Ar aliasIP Ns : Ns Xo 239.Ar aliasPORT 240.Xc 241.Oo Ar remoteIP Ns 242.Op : Ns Ar remotePORT 243.Oc 244.Xc 245.It Fl redirect_address Xo 246.Ar localIP Ns Oo , Ns 247.Ar localIP Ns Oo , Ns 248.Ar ...\& 249.Oc Oc 250.Ar publicIP 251.Xc 252These forms of 253.Fl redirect_port 254and 255.Fl redirect_address 256are used to transparently offload network load on a single server and 257distribute the load across a pool of servers. 258This function is known as 259.Em LSNAT 260(RFC 2391). 261For example, the argument 262.Pp 263.Dl Ar tcp www1:http,www2:http,www3:http www:http 264.Pp 265means that incoming HTTP requests for host www will be transparently 266redirected to one of the www1, www2 or www3, where a host is selected 267simply on a round-robin basis, without regard to load on the net. 268.It Fl dynamic 269If the 270.Fl n 271or 272.Fl interface 273option is used, 274.Nm 275will monitor the routing socket for alterations to the 276.Ar interface 277passed. 278If the interface's IP number is changed, 279.Nm 280will dynamically alter its concept of the alias address. 281.It Fl in_port | i Ar port 282Read from and write to 283.Xr divert 4 284port 285.Ar port , 286treating all packets as 287.Dq incoming . 288.It Fl out_port | o Ar port 289Read from and write to 290.Xr divert 4 291port 292.Ar port , 293treating all packets as 294.Dq outgoing . 295.It Fl port | p Ar port 296Read from and write to 297.Xr divert 4 298port 299.Ar port , 300distinguishing packets as 301.Dq incoming 302or 303.Dq outgoing 304using the rules specified in 305.Xr divert 4 . 306If 307.Ar port 308is not numeric, it is searched for in the 309.Xr services 5 310database. 311If this option is not specified, the divert port named 312.Ar natd 313will be used as a default. 314.It Fl alias_address | a Ar address 315Use 316.Ar address 317as the aliasing address. 318If this option is not specified, the 319.Fl interface 320option must be used. 321The specified address is usually the address assigned to the 322.Dq public 323network interface. 324.Pp 325All data passing 326.Em out 327will be rewritten with a source address equal to 328.Ar address . 329All data coming 330.Em in 331will be checked to see if it matches any already-aliased outgoing 332connection. 333If it does, the packet is altered accordingly. 334If not, all 335.Fl redirect_port , 336.Fl redirect_proto 337and 338.Fl redirect_address 339assignments are checked and actioned. 340If no other action can be made and if 341.Fl deny_incoming 342is not specified, the packet is delivered to the local machine 343using the rules specified in 344.Fl target_address 345option below. 346.It Fl t | target_address Ar address 347Set the target address. 348When an incoming packet not associated with any pre-existing link 349arrives at the host machine, it will be sent to the specified 350.Ar address . 351.Pp 352The target address may be set to 353.Ar 255.255.255.255 , 354in which case all new incoming packets go to the alias address set by 355.Fl alias_address 356or 357.Fl interface . 358.Pp 359If this option is not used, or called with the argument 360.Ar 0.0.0.0 , 361then all new incoming packets go to the address specified in 362the packet. 363This allows external machines to talk directly to internal machines if 364they can route packets to the machine in question. 365.It Fl interface | n Ar interface 366Use 367.Ar interface 368to determine the aliasing address. 369If there is a possibility that the IP number associated with 370.Ar interface 371may change, the 372.Fl dynamic 373option should also be used. 374If this option is not specified, the 375.Fl alias_address 376option must be used. 377.Pp 378The specified 379.Ar interface 380is usually the 381.Dq public 382(or 383.Dq external ) 384network interface. 385.It Fl config | f Ar file 386Read configuration from 387.Ar file . 388A 389.Ar file 390should contain a list of options, one per line, in the same form 391as the long form of the above command line options. 392For example, the line 393.Pp 394.Dl alias_address 158.152.17.1 395.Pp 396would specify an alias address of 158.152.17.1. 397Options that do not take an argument are specified with an argument of 398.Ar yes 399or 400.Ar no 401in the configuration file. 402For example, the line 403.Pp 404.Dl log yes 405.Pp 406is synonymous with 407.Fl log . 408.Pp 409Trailing spaces and empty lines are ignored. 410A 411.Ql \&# 412sign will mark the rest of the line as a comment. 413.It Fl reverse 414This option makes 415.Nm 416reverse the way it handles 417.Dq incoming 418and 419.Dq outgoing 420packets, allowing it to operate on the 421.Dq internal 422network interface rather than the 423.Dq external 424one. 425.Pp 426This can be useful in some transparent proxying situations 427when outgoing traffic is redirected to the local machine 428and 429.Nm 430is running on the internal interface (it usually runs on the 431external interface). 432.It Fl proxy_only 433Force 434.Nm 435to perform transparent proxying only. 436Normal address translation is not performed. 437.It Fl proxy_rule Xo 438.Op Ar type encode_ip_hdr | encode_tcp_stream 439.Ar port xxxx 440.Ar server a.b.c.d:yyyy 441.Xc 442Enable transparent proxying. 443Outgoing TCP packets with the given port going through this 444host to any other host are redirected to the given server and port. 445Optionally, the original target address can be encoded into the packet. 446Use 447.Ar encode_ip_hdr 448to put this information into the IP option field or 449.Ar encode_tcp_stream 450to inject the data into the beginning of the TCP stream. 451.It Fl punch_fw Xo 452.Ar basenumber Ns : Ns Ar count 453.Xc 454This option directs 455.Nm 456to 457.Dq punch holes 458in an 459.Xr ipfirewall 4 460based firewall for FTP/IRC DCC connections. 461This is done dynamically by installing temporary firewall rules which 462allow a particular connection (and only that connection) to go through 463the firewall. 464The rules are removed once the corresponding connection terminates. 465.Pp 466A maximum of 467.Ar count 468rules starting from the rule number 469.Ar basenumber 470will be used for punching firewall holes. 471The range will be cleared for all rules on startup. 472.It Fl log_ipfw_denied 473Log when a packet cannot be re-injected because an 474.Xr ipfw 8 475rule blocks it. 476This is the default with 477.Fl verbose . 478.El 479.Sh RUNNING NATD 480The following steps are necessary before attempting to run 481.Nm : 482.Bl -enum 483.It 484Build a custom kernel with the following options: 485.Bd -literal -offset indent 486options IPFIREWALL 487options IPDIVERT 488.Ed 489.Pp 490Refer to the handbook for detailed instructions on building a custom 491kernel. 492.It 493Ensure that your machine is acting as a gateway. 494This can be done by specifying the line 495.Pp 496.Dl gateway_enable=YES 497.Pp 498in the 499.Pa /etc/rc.conf 500file or using the command 501.Pp 502.Dl "sysctl net.inet.ip.forwarding=1" 503.Pp 504.It 505If you use the 506.Fl interface 507option, make sure that your interface is already configured. 508If, for example, you wish to specify 509.Ql tun0 510as your 511.Ar interface , 512and you are using 513.Xr ppp 8 514on that interface, you must make sure that you start 515.Nm ppp 516prior to starting 517.Nm . 518.El 519.Pp 520Running 521.Nm 522is fairly straight forward. 523The line 524.Pp 525.Dl natd -interface ed0 526.Pp 527should suffice in most cases (substituting the correct interface name). 528Please check 529.Xr rc.conf 5 530on how to configure it to be started automatically during boot. 531Once 532.Nm 533is running, you must ensure that traffic is diverted to 534.Nm : 535.Bl -enum 536.It 537You will need to adjust the 538.Pa /etc/rc.firewall 539script to taste. 540If you are not interested in having a firewall, the 541following lines will do: 542.Bd -literal -offset indent 543/sbin/ipfw -f flush 544/sbin/ipfw add divert natd all from any to any via ed0 545/sbin/ipfw add pass all from any to any 546.Ed 547.Pp 548The second line depends on your interface (change 549.Ql ed0 550as appropriate). 551.Pp 552You should be aware of the fact that, with these firewall settings, 553everyone on your local network can fake his source-address using your 554host as gateway. 555If there are other hosts on your local network, you are strongly 556encouraged to create firewall rules that only allow traffic to and 557from trusted hosts. 558.Pp 559If you specify real firewall rules, it is best to specify line 2 at 560the start of the script so that 561.Nm 562sees all packets before they are dropped by the firewall. 563.Pp 564After translation by 565.Nm , 566packets re-enter the firewall at the rule number following the rule number 567that caused the diversion (not the next rule if there are several at the 568same number). 569.It 570Enable your firewall by setting 571.Pp 572.Dl firewall_enable=YES 573.Pp 574in 575.Pa /etc/rc.conf . 576This tells the system startup scripts to run the 577.Pa /etc/rc.firewall 578script. 579If you do not wish to reboot now, just run this by hand from the console. 580NEVER run this from a remote session unless you put it into the background. 581If you do, you will lock yourself out after the flush takes place, and 582execution of 583.Pa /etc/rc.firewall 584will stop at this point - blocking all accesses permanently. 585Running the script in the background should be enough to prevent this 586disaster. 587.El 588.Sh SEE ALSO 589.Xr libalias 3 , 590.Xr divert 4 , 591.Xr protocols 5 , 592.Xr rc.conf 5 , 593.Xr services 5 , 594.Xr syslog.conf 5 , 595.Xr ipfw 8 , 596.Xr ppp 8 597.Sh AUTHORS 598This program is the result of the efforts of many people at different 599times: 600.Pp 601.An Archie Cobbs Aq archie@FreeBSD.org 602(divert sockets) 603.An Charles Mott Aq cm@linktel.net 604(packet aliasing) 605.An Eivind Eklund Aq perhaps@yes.no 606(IRC support & misc additions) 607.An Ari Suutari Aq suutari@iki.fi 608(natd) 609.An Dru Nelson Aq dnelson@redwoodsoft.com 610(early PPTP support) 611.An Brian Somers Aq brian@awfulhak.org 612(glue) 613.An Ruslan Ermilov Aq ru@FreeBSD.org 614(natd, packet aliasing, glue) 615