natd.tproj/natd.8

   1 .\" manual page [] for natd 1.4
   2 .\"     $Id: natd.8,v 1.6 2004/10/21 21:48:41 vazquez Exp $
   3 .Dd June 27, 2000
   4 .Os Darwin
   5 .Dt NATD 8
   6 .Sh NAME
   7 .Nm natd
   8 .Nd Network Address Translation daemon
   9 .Sh SYNOPSIS
  10 .Nm
  11 .Bk -words
  12 .Op Fl unregistered_only | u
  13 .Op Fl log | l
  14 .Op Fl proxy_only
  15 .Op Fl reverse
  16 .Op Fl deny_incoming | d
  17 .Op Fl use_sockets | s
  18 .Op Fl same_ports | m
  19 .Op Fl verbose | v
  20 .Op Fl dynamic
  21 .Op Fl in_port | i Ar port
  22 .Op Fl out_port | o Ar port
  23 .Op Fl port | p Ar port
  24 .Op Fl alias_address | a Ar address
  25 .Op Fl target_address | t Ar address
  26 .Op Fl interface | n Ar interface
  27 .Op Fl proxy_rule Ar proxyspec
  28 .Op Fl redirect_port Ar linkspec
  29 .Op Fl redirect_proto Ar linkspec
  30 .Op Fl redirect_address Ar linkspec
  31 .Op Fl config | f Ar configfile
  32 .Op Fl log_denied
  33 .Op Fl log_facility Ar facility_name
  34 .Op Fl punch_fw Ar firewall_range
  35 .Op Fl clamp_mss
  36 .Op Fl enable_natportmap
  37 .Op Fl natportmap_interface Ar interface
  38 .Ek
  39 .Sh DESCRIPTION
  40 This program provides a Network Address Translation facility for use
  41 with
  42 .Xr divert 4
  43 sockets under
  44 .Fx .
  45 .Pp
  46 The
  47 .Nm
  48 normally runs in the background as a daemon.
  49 It is passed raw IP packets as they travel into and out of the machine,
  50 and will possibly change these before re-injecting them back into the
  51 IP packet stream.
  52 .Pp
  53 It changes all packets destined for another host so that their source
  54 IP number is that of the current machine.
  55 For each packet changed in this manner, an internal table entry is
  56 created to record this fact.
  57 The source port number is also changed to indicate the table entry
  58 applying to the packet.
  59 Packets that are received with a target IP of the current host are
  60 checked against this internal table.
  61 If an entry is found, it is used to determine the correct target IP
  62 number and port to place in the packet.
  63 .Pp
  64 The following command line options are available:
  65 .Bl -tag -width Fl
  66 .It Fl log | l
  67 Log various aliasing statistics and information to the file
  68 .Pa /var/log/alias.log .
  69 This file is truncated each time
  70 .Nm
  71 is started.
  72 .It Fl deny_incoming | d
  73 Do not pass incoming packets that have no
  74 entry in the internal translation table.
  75 .Pp
  76 If this option is not used, then such a packet will be altered
  77 using the rules in
  78 .Fl target_address
  79 below, and the entry will be made in the internal translation table.
  80 .It Fl log_denied
  81 Log denied incoming packets via
  82 .Xr syslog 3
  83 .Po
  84 see also
  85 .Fl log_facility
  86 .Pc .
  87 .It Fl log_facility Ar facility_name
  88 Use specified log facility when logging information via
  89 .Xr syslog 3 .
  90 Argument
  91 .Ar facility_name
  92 is one of the keywords specified in
  93 .Xr syslog.conf 5 .
  94 .It Fl use_sockets | s
  95 Allocate a
  96 .Xr socket 2
  97 in order to establish an FTP data or IRC DCC send connection.
  98 This option uses more system resources, but guarantees successful
  99 connections when port numbers conflict.
 100 .It Fl same_ports | m
 101 Try to keep the same port number when altering outgoing packets.
 102 With this option, protocols such as RPC will have a better chance
 103 of working.
 104 If it is not possible to maintain the port number, it will be silently
 105 changed as per normal.
 106 .It Fl verbose | v
 107 Do not call
 108 .Xr daemon 3
 109 on startup.  Instead, stay attached to the controlling terminal and
 110 display all packet alterations to the standard output.  This option
 111 should only be used for debugging purposes.
 112 .It Fl unregistered_only | u
 113 Only alter outgoing packets with an
 114 .Em unregistered
 115 source address.
 116 According to RFC 1918, unregistered source addresses are 10.0.0.0/8,
 117 172.16.0.0/12 and 192.168.0.0/16.
 118 .It Fl redirect_port Ar proto Xo
 119 .Ar targetIP Ns : Ns Xo
 120 .Ar targetPORT Ns Op - Ns Ar targetPORT Xc
 121 .Op Ar aliasIP Ns : Ns Xo
 122 .Ar aliasPORT Ns Op - Ns Ar aliasPORT Xc
 123 .Oo Ar remoteIP Ns Oo : Ns
 124 .Ar remotePORT Ns Op - Ns Ar remotePORT
 125 .Oc Oc
 126 .Xc
 127 Redirect incoming connections arriving to given port(s) to another host
 128 and port(s).
 129 Argument
 130 .Ar proto
 131 is either
 132 .Ar tcp
 133 or
 134 .Ar udp ,
 135 .Ar targetIP
 136 is the desired target IP number,
 137 .Ar targetPORT
 138 is the desired target port number or range,
 139 .Ar aliasPORT
 140 is the requested port number or range, and
 141 .Ar aliasIP
 142 is the aliasing address.
 143 Arguments
 144 .Ar remoteIP
 145 and
 146 .Ar remotePORT
 147 can be used to specify the connection more accurately if necessary.
 148 The
 149 .Ar targetPORT
 150 range and
 151 .Ar aliasPORT
 152 range need not be the same numerically, but must have the same size.
 153 If
 154 .Ar remotePORT
 155 is not specified, it is assumed to be all ports.
 156 If
 157 .Ar remotePORT
 158 is specified, it must match the size of
 159 .Ar targetPORT ,
 160 or be 0 (all ports).
 161 For example, the argument
 162 .Pp
 163 .Dl Ar tcp inside1:telnet 6666
 164 .Pp
 165 means that incoming TCP packets destined for port 6666 on this machine
 166 will be sent to the telnet port on the inside1 machine.
 167 .Pp
 168 .Dl Ar tcp inside2:2300-2399 3300-3399
 169 .Pp
 170 will redirect incoming connections on ports 3300-3399 to host
 171 inside2, ports 2300-2399.
 172 The mapping is 1:1 meaning port 3300 maps to 2300, 3301 maps to 2301, etc.
 173 .It Fl redirect_proto Ar proto localIP Oo
 174 .Ar publicIP Op Ar remoteIP
 175 .Oc
 176 Redirect incoming IP packets of protocol
 177 .Ar proto
 178 .Po see Xr protocols 5
 179 .Pc
 180 destined for
 181 .Ar publicIP
 182 address to a
 183 .Ar localIP
 184 address and vice versa.
 185 .Pp
 186 If
 187 .Ar publicIP
 188 is not specified, then the default aliasing address is used.
 189 If
 190 .Ar remoteIP
 191 is specified, then only packets coming from/to
 192 .Ar remoteIP
 193 will match the rule.
 194 .It Fl redirect_address Ar localIP publicIP
 195 Redirect traffic for public IP address to a machine on the local
 196 network.
 197 This function is known as
 198 .Em static NAT .
 199 Normally static NAT is useful if your ISP has allocated a small block
 200 of IP addresses to you, but it can even be used in the case of single
 201 address:
 202 .Pp
 203 .Dl Ar redirect_address 10.0.0.8 0.0.0.0
 204 .Pp
 205 The above command would redirect all incoming traffic
 206 to machine 10.0.0.8.
 207 .Pp
 208 If several address aliases specify the same public address
 209 as follows
 210 .Bd -literal -offset indent
 211 .Ar redirect_address 192.168.0.2 public_addr
 212 .Ar redirect_address 192.168.0.3 public_addr
 213 .Ar redirect_address 192.168.0.4 public_addr
 214 .Ed
 215 .Pp
 216 the incoming traffic will be directed to the last
 217 translated local address (192.168.0.4), but outgoing
 218 traffic from the first two addresses will still be aliased
 219 to appear from the specified
 220 .Ar public_addr .
 221 .It Fl redirect_port Ar proto Xo
 222 .Ar targetIP Ns : Ns Xo
 223 .Ar targetPORT Ns Oo , Ns
 224 .Ar targetIP Ns : Ns Xo
 225 .Ar targetPORT Ns Oo , Ns
 226 .Ar ...\&
 227 .Oc Oc
 228 .Xc
 229 .Xc
 230 .Op Ar aliasIP Ns : Ns Xo
 231 .Ar aliasPORT
 232 .Xc
 233 .Oo Ar remoteIP Ns
 234 .Op : Ns Ar remotePORT
 235 .Oc
 236 .Xc
 237 .It Fl redirect_address Xo
 238 .Ar localIP Ns Oo , Ns
 239 .Ar localIP Ns Oo , Ns
 240 .Ar ...\&
 241 .Oc Oc
 242 .Ar publicIP
 243 .Xc
 244 These forms of
 245 .Fl redirect_port
 246 and
 247 .Fl redirect_address
 248 are used to transparently offload network load on a single server and
 249 distribute the load across a pool of servers.
 250 This function is known as
 251 .Em LSNAT
 252 (RFC 2391).
 253 For example, the argument
 254 .Pp
 255 .Dl Ar tcp www1:http,www2:http,www3:http www:http
 256 .Pp
 257 means that incoming HTTP requests for host www will be transparently
 258 redirected to one of the www1, www2 or www3, where a host is selected
 259 simply on a round-robin basis, without regard to load on the net.
 260 .It Fl dynamic
 261 If the
 262 .Fl n
 263 or
 264 .Fl interface
 265 option is used,
 266 .Nm
 267 will monitor the routing socket for alterations to the
 268 .Ar interface
 269 passed.
 270 If the interface's IP number is changed,
 271 .Nm
 272 will dynamically alter its concept of the alias address.
 273 .It Fl in_port | i Ar port
 274 Read from and write to
 275 .Xr divert 4
 276 port
 277 .Ar port ,
 278 treating all packets as
 279 .Dq incoming .
 280 .It Fl out_port | o Ar port
 281 Read from and write to
 282 .Xr divert 4
 283 port
 284 .Ar port ,
 285 treating all packets as
 286 .Dq outgoing .
 287 .It Fl port | p Ar port
 288 Read from and write to
 289 .Xr divert 4
 290 port
 291 .Ar port ,
 292 distinguishing packets as
 293 .Dq incoming
 294 or
 295 .Dq outgoing
 296 using the rules specified in
 297 .Xr divert 4 .
 298 If
 299 .Ar port
 300 is not numeric, it is searched for in the
 301 .Xr services 5
 302 database.
 303 If this option is not specified, the divert port named
 304 .Ar natd
 305 will be used as a default.
 306 .It Fl alias_address | a Ar address
 307 Use
 308 .Ar address
 309 as the aliasing address.
 310 If this option is not specified, the
 311 .Fl interface
 312 option must be used.
 313 The specified address is usually the address assigned to the
 314 .Dq public
 315 network interface.
 316 .Pp
 317 All data passing
 318 .Em out
 319 will be rewritten with a source address equal to
 320 .Ar address .
 321 All data coming
 322 .Em in
 323 will be checked to see if it matches any already-aliased outgoing
 324 connection.
 325 If it does, the packet is altered accordingly.
 326 If not, all
 327 .Fl redirect_port ,
 328 .Fl redirect_proto
 329 and
 330 .Fl redirect_address
 331 assignments are checked and actioned.
 332 If no other action can be made and if
 333 .Fl deny_incoming
 334 is not specified, the packet is delivered to the local machine
 335 using the rules specified in
 336 .Fl target_address
 337 option below.
 338 .It Fl t | target_address Ar address
 339 Set the target address.
 340 When an incoming packet not associated with any pre-existing link
 341 arrives at the host machine, it will be sent to the specified
 342 .Ar address .
 343 .Pp
 344 The target address may be set to
 345 .Ar 255.255.255.255 ,
 346 in which case all new incoming packets go to the alias address set by
 347 .Fl alias_address
 348 or
 349 .Fl interface .
 350 .Pp
 351 If this option is not used, or called with the argument
 352 .Ar 0.0.0.0 ,
 353 then all new incoming packets go to the address specified in
 354 the packet.
 355 This allows external machines to talk directly to internal machines if
 356 they can route packets to the machine in question.
 357 .It Fl interface | n Ar interface
 358 Use
 359 .Ar interface
 360 to determine the aliasing address.
 361 If there is a possibility that the IP number associated with
 362 .Ar interface
 363 may change, the
 364 .Fl dynamic
 365 option should also be used.
 366 If this option is not specified, the
 367 .Fl alias_address
 368 option must be used.
 369 .Pp
 370 The specified
 371 .Ar interface
 372 is usually the
 373 .Dq public
 374 (or
 375 .Dq external )
 376 network interface.
 377 .It Fl config | f Ar file
 378 Read configuration from
 379 .Ar file .
 380 A
 381 .Ar file
 382 should contain a list of options, one per line, in the same form
 383 as the long form of the above command line options.
 384 For example, the line
 385 .Pp
 386 .Dl alias_address 158.152.17.1
 387 .Pp
 388 would specify an alias address of 158.152.17.1.
 389 Options that do not take an argument are specified with an argument of
 390 .Ar yes
 391 or
 392 .Ar no
 393 in the configuration file.  For example, the line
 394   log yes
 395 is synonymous with
 396 .Fl log .
 397 .Pp
 398 Trailing spaces and empty lines are ignored.
 399 A
 400 .Ql \&#
 401 sign will mark the rest of the line as a comment.
 402 .It Fl reverse
 403 This option makes
 404 .Nm
 405 reverse the way it handles
 406 .Dq incoming
 407 and
 408 .Dq outgoing
 409 packets, allowing it to operate on the
 410 .Dq internal
 411 network interface rather than the
 412 .Dq external
 413 one.
 414 .Pp
 415 This can be useful in some transparent proxying situations
 416 when outgoing traffic is redirected to the local machine
 417 and
 418 .Nm
 419 is running on the internal interface (it usually runs on the
 420 external interface).
 421 .It Fl proxy_only
 422 Force
 423 .Nm
 424 to perform transparent proxying only.
 425 Normal address translation is not performed.
 426 .It Fl proxy_rule Xo
 427 .Op Ar type encode_ip_hdr | encode_tcp_stream
 428 .Ar port xxxx
 429 .Ar server a.b.c.d:yyyy
 430 .Xc
 431 Enable transparent proxying.
 432 Outgoing TCP packets with the given port going through this
 433 host to any other host are redirected to the given server and port.
 434 Optionally, the original target address can be encoded into the packet.
 435 Use
 436 .Ar encode_ip_hdr
 437 to put this information into the IP option field or
 438 .Ar encode_tcp_stream
 439 to inject the data into the beginning of the TCP stream.
 440 .It Fl punch_fw Xo
 441 .Ar basenumber Ns : Ns Ar count
 442 .Xc
 443 This option directs
 444 .Nm
 445 to
 446 .Dq punch holes
 447 in an
 448 .Xr ipfirewall 4
 449 based firewall for FTP/IRC DCC connections.
 450 This is done dynamically by installing temporary firewall rules which
 451 allow a particular connection (and only that connection) to go through
 452 the firewall.
 453 The rules are removed once the corresponding connection terminates.
 454 .Pp
 455 A maximum of
 456 .Ar count
 457 rules starting from the rule number
 458 .Ar basenumber
 459 will be used for punching firewall holes.
 460 The range will be cleared for all rules on startup.
 461 .It Fl clamp_mss Xo
 462 .Xc
 463 This option enables MSS clamping.  The MSS value is derived from the
 464 MTU of the interface specified in the
 465 .Fl interface
 466 option.
 467 .It Fl enable_natportmap Xo
 468 .Xc
 469 This option enables port forwarding using the NATPMP protocol.
 470 .It Fl natportmap_interface Ar interface Xo
 471 .Xc
 472 This option instructs natd to listen for NATPMP requests. This option should appear for each
 473 interface on which natd will listen for NATPMP requests.
 474 .El
 475 .Sh RUNNING NATD
 476 The following steps are necessary before attempting to run
 477 .Nm :
 478 .Bl -enum
 479 .It
 480 Ensure that your machine is acting as a gateway.
 481 This can be done by using the command
 482 .Pp
 483 .Dl sysctl -w net.inet.ip.forwarding=1
 484 .Pp
 485 .It
 486 If you use the
 487 .Fl interface
 488 option, make sure that your interface is already configured.
 489 If, for example, you wish to specify
 490 .Ql tun0
 491 as your
 492 .Ar interface ,
 493 and you are using
 494 .Xr ppp 8
 495 on that interface, you must make sure that you start
 496 .Nm ppp
 497 prior to starting
 498 .Nm .
 499 .El
 500 .Pp
 501 Running
 502 .Nm
 503 is fairly straight forward.
 504 The line
 505 .Pp
 506 .Dl natd -interface en0
 507 .Pp
 508 should suffice in most cases (substituting the correct interface name).
 509 .Pp
 510 Once
 511 .Nm
 512 is running, you must ensure that traffic is diverted to
 513 .Nm :
 514 .Bl -enum
 515 .It
 516 If you are not interested in having a firewall, the
 517 following lines will do:
 518 .Bd -literal -offset indent
 519 /sbin/ipfw -f flush
 520 /sbin/ipfw add divert natd all from any to any via en0
 521 /sbin/ipfw add pass all from any to any
 522 .Ed
 523 .Pp
 524 The second line depends on your interface (change
 525 .Ql en0
 526 as appropriate).
 527 .Pp
 528 You should be aware of the fact that, with these firewall settings,
 529 everyone on your local network can fake his source-address using your
 530 host as gateway.
 531 If there are other hosts on your local network, you are strongly
 532 encouraged to create firewall rules that only allow traffic to and
 533 from trusted hosts.
 534 .Pp
 535 If you specify real firewall rules, it is best to specify line 2 at
 536 the start of the rules so that
 537 .Nm
 538 sees all packets before they are dropped by the firewall.
 539 .Pp
 540 After translation by
 541 .Nm ,
 542 packets re-enter the firewall at the rule number following the rule number
 543 that caused the diversion (not the next rule if there are several at the
 544 same number).
 545 .It
 546 Enable your firewall by using the command
 547 .Pp
 548 .Dl sysctl -w net.inet.ip.fw.enable=1
 549 .Pp
 550 .El
 551 .Sh SEE ALSO
 552 .Xr divert 4 ,
 553 .Xr protocols 5 ,
 554 .Xr rc.conf 5 ,
 555 .Xr services 5 ,
 556 .Xr syslog.conf 5 ,
 557 .Xr ipfw 8 ,
 558 .Xr ppp 8
 559 .Sh AUTHORS
 560 This program is the result of the efforts of many people at different
 561 times:
 562 .Pp
 563 .An Archie Cobbs Aq archie@whistle.com
 564 (divert sockets)
 565 .An Charles Mott Aq cmott@scientech.com
 566 (packet aliasing)
 567 .An Eivind Eklund Aq perhaps@yes.no
 568 (IRC support & misc additions)
 569 .An Ari Suutari Aq suutari@iki.fi
 570 (natd)
 571 .An Dru Nelson Aq dnelson@redwoodsoft.com
 572 (early PPTP support)
 573 .An Brian Somers Aq brian@awfulhak.org
 574 (glue)
 575 .An Ruslan Ermilov Aq ru@FreeBSD.org
 576 (natd, packet aliasing, glue)