xref: /freebsd/share/man/man4/ng_nat.4 (revision e842c54054b846061bf92d0f8a23ee3126ede6a9)

.\" Copyright (c) 2005 Gleb Smirnoff <glebius@FreeBSD.org>
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.\" $FreeBSD$
.\"
.Dd May 6, 2005
.Dt NG_NAT 4
.Os
.Sh NAME
.Nm ng_nat
.Nd "NAT netgraph node type"
.Sh SYNOPSIS
.In netgraph/ng_nat.h
.Sh DESCRIPTION
An
.Nm
node performs network address translation (NAT) of packets
passing through it.
A
.Nm nat
node uses
.Xr libalias 3
engine for packet aliasing.
At this moment it supports only the basic functionality of the library.
.Sh HOOKS
This node type has two hooks:
.Bl -tag -width indent
.It Va out
Packets received on this hook are considered outgoing and will be
masqueraded to a configured address.
.It Va in
Packets coming on this hook are considered incoming and will be
dealiased.
.El
.Sh CONTROL MESSAGES
This node type supports the generic control messages, plus the following:
.Bl -tag -width indent
.It Dv NGM_NAT_SET_IPADDR Pq Li setaliasaddr
Configure aliasing address for a node.
After both hooks have been connected and aliasing address was configured,
a node is ready for aliasing operation.
.It Dv NGM_NAT_SET_MODE Pq Li setmode
Set node's operation mode using supplied
.Vt "struct ng_nat_mode".
.Bd -literal
struct ng_nat_mode {
	uint32_t	flags;
	uint32_t	mask;
};
/* Supported flags: */
#define NG_NAT_LOG			0x01
#define NG_NAT_DENY_INCOMING		0x02
#define NG_NAT_SAME_PORTS		0x04
#define NG_NAT_UNREGISTERED_ONLY	0x10
#define NG_NAT_RESET_ON_ADDR_CHANGE	0x20
#define NG_NAT_PROXY_ONLY		0x40
#define NG_NAT_REVERSE			0x80
.Ed
.It Dv NGM_NAT_SET_TARGET Pq Li settarget
Configure target address for a node.
When an incoming packet not associated with any pre-existing aliasing
link arrives at the host machine, it will be sent to the specified address.
.El
.Sh SHUTDOWN
This node shuts down upon receipt of a
.Dv NGM_SHUTDOWN
control message, or when both hooks are disconnected.
.Sh EXAMPLES
In the following example, the packets are injected into a
.Nm nat
node using the
.Xr ng_ipfw 4
node.
.Bd -literal -offset indent
# Create NAT node
ngctl mkpeer ipfw: nat 60 out
ngctl name ipfw:60 nat
ngctl connect ipfw: nat: 61 in
ngctl msg nat: setaliasaddr x.y.35.8

# Divert traffic into NAT node
ipfw add 300 netgraph 61 all from any to any in via fxp0
ipfw add 400 netgraph 60 all from any to any out via fxp0

# Let packets continue with after being (de)aliased
sysctl net.inet.ip.fw.one_pass=0
.Ed
.Pp
The
.Nm
node can be inserted right after the
.Xr ng_iface 4
node in the graph.
In the following example, we perform masquerading on a
serial line with HDLC encapsulation.
.Bd -literal -offset indent
/usr/sbin/ngctl -f- <<-SEQ
	mkpeer cp0: cisco rawdata downstream
	name cp0:rawdata hdlc
	mkpeer hdlc: nat inet in
	name hdlc:inet nat
	mkpeer nat: iface out inet
	msg nat: setaliasaddr x.y.8.35
SEQ
ifconfig ng0 x.y.8.35 x.y.8.1
.Ed
.Sh SEE ALSO
.Xr libalias 3 ,
.Xr ng_ipfw 4 ,
.Xr natd 8 ,
.Xr ngctl 8
.Sh HISTORY
The
.Nm
node type was implemented in
.Fx 6.0 .
.Sh AUTHORS
.An Gleb Smirnoff Aq glebius@FreeBSD.org