download

Chapter 12Network Address Translation using PFand IPFWDifferent methods of NAT can be implemented using both PF and IPFW in FreeBSD.Several combinations are listed here:• IPFW in conjunction with natd(8)• IPFW and in-kernel NAT (libalias)• built-in PF NATPrior to FreeBSD 7, there was no built-in support for NAT in IPFW. This is wherenatd(8) kicks in. IPFW can be used to divert raw traffic to natd(8) daemon,which is a network address translation daemon. IPFW cannot divert packets, unlessnecessary kernel options are enabled:optionsIPDIVERTAdding this line to your kernel configuration enables your kernel to be able to divertraw IP packets to an external daemon, using the IPFW's divert rule:# ipfw add divert natd ip from any to any via fxp0Using this rule, ipfw redirects all ip traffic that is passing from the fxp0 interface tonatd daemon. The natd daemon then decides whether the packet should be translatedor not, and then re-injects the packet into the network stack after processing.The configuration for natd daemon is pretty straightforward. The daemon should beenabled from the /etc/rc.conf configuration file, as usual:natd_enable="YES"This basically enableas natd(8) daemon to start automatically, upon systemboot. However, you should also tell natd, which interface is your public or WANinterface, so that natd uses the addresses on that interface for translation. This can bedone using variables in the /etc/rc.conf file:natd_interface="bge0"natd_flags="-u -l"This is a typical scenario where we have enabled natd and configured it to translatetraffic to the address that is configured on interface bge0. There are also two importantoptions we have configured along with natd. The first parameter, -u, tells natdto translate only the traffic, whose source address is an "unregistered" or basicallyRFC1918 (private) addresses. This is very useful in a typical NAT scenario, whereyou want to translate all traffic from private addresses to a public address. The otherparameter we used is -l that logs some statistics to the /var/log/alias.log file.[ 199 ]