1.\" Copyright (c) 2005 Gleb Smirnoff <glebius@FreeBSD.org> 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD$ 26.\" 27.Dd May 6, 2005 28.Dt NG_NAT 4 29.Os 30.Sh NAME 31.Nm ng_nat 32.Nd "NAT netgraph node type" 33.Sh SYNOPSIS 34.In netgraph/ng_nat.h 35.Sh DESCRIPTION 36An 37.Nm 38node performs network address translation (NAT) of packets 39passing through it. 40A 41.Nm nat 42node uses 43.Xr libalias 3 44engine for packet aliasing. 45At this moment it supports only the basic functionality of the library. 46.Sh HOOKS 47This node type has two hooks: 48.Bl -tag -width indent 49.It Va out 50Packets received on this hook are considered outgoing and will be 51masqueraded to a configured address. 52.It Va in 53Packets coming on this hook are considered incoming and will be 54dealiased. 55.El 56.Sh CONTROL MESSAGES 57This node type supports the generic control messages, plus the following: 58.Bl -tag -width indent 59.It Dv NGM_NAT_SET_IPADDR Pq Li setaliasaddr 60Configure aliasing address for a node. 61After both hooks have been connected and aliasing address was configured, 62a node is ready for aliasing operation. 63.It Dv NGM_NAT_SET_MODE Pq Li setmode 64Set node's operation mode using supplied 65.Vt "struct ng_nat_mode". 66.Bd -literal 67struct ng_nat_mode { 68 uint32_t flags; 69 uint32_t mask; 70}; 71/* Supported flags: */ 72#define NG_NAT_LOG 0x01 73#define NG_NAT_DENY_INCOMING 0x02 74#define NG_NAT_SAME_PORTS 0x04 75#define NG_NAT_UNREGISTERED_ONLY 0x10 76#define NG_NAT_RESET_ON_ADDR_CHANGE 0x20 77#define NG_NAT_PROXY_ONLY 0x40 78#define NG_NAT_REVERSE 0x80 79.Ed 80.It Dv NGM_NAT_SET_TARGET Pq Li settarget 81Configure target address for a node. 82When an incoming packet not associated with any pre-existing aliasing 83link arrives at the host machine, it will be sent to the specified address. 84.El 85.Sh SHUTDOWN 86This node shuts down upon receipt of a 87.Dv NGM_SHUTDOWN 88control message, or when both hooks are disconnected. 89.Sh EXAMPLES 90In the following example, the packets are injected into a 91.Nm nat 92node using the 93.Xr ng_ipfw 4 94node. 95.Bd -literal -offset indent 96# Create NAT node 97ngctl mkpeer ipfw: nat 60 out 98ngctl name ipfw:60 nat 99ngctl connect ipfw: nat: 61 in 100ngctl msg nat: setaliasaddr x.y.35.8 101 102# Divert traffic into NAT node 103ipfw add 300 netgraph 61 all from any to any in via fxp0 104ipfw add 400 netgraph 60 all from any to any out via fxp0 105 106# Let packets continue with after being (de)aliased 107sysctl net.inet.ip.fw.one_pass=0 108.Ed 109.Pp 110The 111.Nm 112node can be inserted right after the 113.Xr ng_iface 4 114node in the graph. 115In the following example, we perform masquerading on a 116serial line with HDLC encapsulation. 117.Bd -literal -offset indent 118/usr/sbin/ngctl -f- <<-SEQ 119 mkpeer cp0: cisco rawdata downstream 120 name cp0:rawdata hdlc 121 mkpeer hdlc: nat inet in 122 name hdlc:inet nat 123 mkpeer nat: iface out inet 124 msg nat: setaliasaddr x.y.8.35 125SEQ 126ifconfig ng0 x.y.8.35 x.y.8.1 127.Ed 128.Sh SEE ALSO 129.Xr libalias 3 , 130.Xr ng_ipfw 4 , 131.Xr natd 8 , 132.Xr ngctl 8 133.Sh HISTORY 134The 135.Nm 136node type was implemented in 137.Fx 6.0 . 138.Sh AUTHORS 139.An Gleb Smirnoff Aq glebius@FreeBSD.org 140