1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
.\" Copyright (c) 2005 Gleb Smirnoff <glebius@FreeBSD.org>
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.\" $FreeBSD$
.\"
.Dd May 6, 2005
.Dt NG_NAT 4
.Os
.Sh NAME
.Nm ng_nat
.Nd "NAT netgraph node type"
.Sh SYNOPSIS
.In netgraph/ng_nat.h
.Sh DESCRIPTION
An
.Nm
node performs network address translation (NAT) of packets
passing through it.
A
.Nm nat
node uses
.Xr libalias 3
engine for packet aliasing.
At this moment it supports only the basic functionality of the library.
.Sh HOOKS
This node type has two hooks:
.Bl -tag -width indent
.It Va out
Packets received on this hook are considered outgoing and will be
masqueraded to a configured address.
.It Va in
Packets coming on this hook are considered incoming and will be
dealiased.
.El
.Sh CONTROL MESSAGES
This node type supports the generic control messages, plus the following:
.Bl -tag -width indent
.It Dv NGM_NAT_SET_IPADDR Pq Li setaliasaddr
Configure aliasing address for a node.
After both hooks have been connected and aliasing address was configured,
a node is ready for aliasing operation.
.It Dv NGM_NAT_SET_MODE Pq Li setmode
Set node's operation mode using supplied
.Vt "struct ng_nat_mode".
.Bd -literal
struct ng_nat_mode {
uint32_t flags;
uint32_t mask;
};
/* Supported flags: */
#define NG_NAT_LOG 0x01
#define NG_NAT_DENY_INCOMING 0x02
#define NG_NAT_SAME_PORTS 0x04
#define NG_NAT_UNREGISTERED_ONLY 0x10
#define NG_NAT_RESET_ON_ADDR_CHANGE 0x20
#define NG_NAT_PROXY_ONLY 0x40
#define NG_NAT_REVERSE 0x80
.Ed
.It Dv NGM_NAT_SET_TARGET Pq Li settarget
Configure target address for a node.
When an incoming packet not associated with any pre-existing aliasing
link arrives at the host machine, it will be sent to the specified address.
.El
.Sh SHUTDOWN
This node shuts down upon receipt of a
.Dv NGM_SHUTDOWN
control message, or when both hooks are disconnected.
.Sh EXAMPLES
In the following example, the packets are injected into a
.Nm nat
node using the
.Xr ng_ipfw 4
node.
.Bd -literal -offset indent
# Create NAT node
ngctl mkpeer ipfw: nat 60 out
ngctl name ipfw:60 nat
ngctl connect ipfw: nat: 61 in
ngctl msg nat: setaliasaddr x.y.35.8
# Divert traffic into NAT node
ipfw add 300 netgraph 61 all from any to any in via fxp0
ipfw add 400 netgraph 60 all from any to any out via fxp0
# Let packets continue with after being (de)aliased
sysctl net.inet.ip.fw.one_pass=0
.Ed
.Pp
The
.Nm
node can be inserted right after the
.Xr ng_iface 4
node in the graph.
In the following example, we perform masquerading on a
serial line with HDLC encapsulation.
.Bd -literal -offset indent
/usr/sbin/ngctl -f- <<-SEQ
mkpeer cp0: cisco rawdata downstream
name cp0:rawdata hdlc
mkpeer hdlc: nat inet in
name hdlc:inet nat
mkpeer nat: iface out inet
msg nat: setaliasaddr x.y.8.35
SEQ
ifconfig ng0 x.y.8.35 x.y.8.1
.Ed
.Sh SEE ALSO
.Xr libalias 3 ,
.Xr ng_ipfw 4 ,
.Xr natd 8 ,
.Xr ngctl 8
.Sh HISTORY
The
.Nm
node type was implemented in
.Fx 6.0 .
.Sh AUTHORS
.An Gleb Smirnoff Aq glebius@FreeBSD.org
|
