diff options
author | piso <piso@FreeBSD.org> | 2006-12-29 21:59:17 +0000 |
---|---|---|
committer | piso <piso@FreeBSD.org> | 2006-12-29 21:59:17 +0000 |
commit | 0db606a3b135b207a944e841f0142c30f4f43ceb (patch) | |
tree | 69ec3c3af60d727edf88005d9af7a9beb78e73fe /sys/netinet/in.h | |
parent | d392a291a28a8cbedf2cc9398d4a03c8467d8c3d (diff) | |
download | FreeBSD-src-0db606a3b135b207a944e841f0142c30f4f43ceb.zip FreeBSD-src-0db606a3b135b207a944e841f0142c30f4f43ceb.tar.gz |
Summer of Code 2005: improve libalias - part 2 of 2
With the second (and last) part of my previous Summer of Code work, we get:
-ipfw's in kernel nat
-redirect_* and LSNAT support
General information about nat syntax and some examples are available
in the ipfw (8) man page. The redirect and LSNAT syntax are identical
to natd, so please refer to natd (8) man page.
To enable in kernel nat in rc.conf, two options were added:
o firewall_nat_enable: equivalent to natd_enable
o firewall_nat_interface: equivalent to natd_interface
Remember to set net.inet.ip.fw.one_pass to 0, if you want the packet
to continue being checked by the firewall ruleset after being
(de)aliased.
NOTA BENE: due to some problems with libalias architecture, in kernel
nat won't work with TSO enabled nic, thus you have to disable TSO via
ifconfig (ifconfig foo0 -tso).
Approved by: glebius (mentor)
Diffstat (limited to 'sys/netinet/in.h')
-rw-r--r-- | sys/netinet/in.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sys/netinet/in.h b/sys/netinet/in.h index 570ed33..321877c 100644 --- a/sys/netinet/in.h +++ b/sys/netinet/in.h @@ -410,6 +410,11 @@ __END_DECLS #define IP_FW_GET 54 /* get entire firewall rule chain */ #define IP_FW_RESETLOG 55 /* reset logging counters */ +#define IP_FW_NAT_CFG 56 /* add/config a nat rule */ +#define IP_FW_NAT_DEL 57 /* delete a nat rule */ +#define IP_FW_NAT_GET_CONFIG 58 /* get configuration of a nat rule */ +#define IP_FW_NAT_GET_LOG 59 /* get log of a nat rule */ + #define IP_DUMMYNET_CONFIGURE 60 /* add/configure a dummynet pipe */ #define IP_DUMMYNET_DEL 61 /* delete a dummynet pipe from chain */ #define IP_DUMMYNET_FLUSH 62 /* flush dummynet */ |