forum.lissyara.su

может ipfw кернел нат переписали и не плохо, но документировали препаршиво, да и примеров в инете очень мало

Согласен.

Давайте общими силами всего форума создадим ман/фак/примеры использования кернел ната. Типа берем функционал старого natd и пробуем то же самое с кернеловским. По-ходу описываем подводные камни.

Нужен план составления.

options         IPFIREWALL              #firewall
options         IPFIREWALL_NAT          #ipfw kernel nat support
options         LIBALIAS                # libalias library, performing NAT

firewall_enable="YES"
firewall_type="/etc/firewall"
gateway_enable="YES"

add check-state
add allow ip from any to any via fxp0
add deny ip from any to 192.168.0.0/16 in via em0
add deny ip from 192.168.0.0/16 to any in via em0
add allow tcp from any to me 6881
add allow udp from any to me 4444
add allow icmp from me to any out keep-state
add allow tcp from me to any out keep-state
add allow udp from me to any out keep-state
nat 1 config if em0 deny_in unreg_only reset
add nat 1 all from any to any via em0
add deny tcp from any to any
add deny udp from any to any
add deny ip from any to any

add allow ip from any to any via fxp0

add allow tcp from any to me 6881
add allow udp from any to me 4444

Код: Выделить всё

     ip ip_address
	     Define an ip address to use for aliasing.

Код: Выделить всё

     -alias_address | -a address
		 Use address as the aliasing address.  Either this or the
		 -interface option must be used (but not both), if the
		 -proxy_only option is not specified.  The specified address
		 is usually the address assigned to the ``public'' network
		 interface.

		 All data passing out will be rewritten with a source address
		 equal to address.  All data coming in will be checked to see
		 if it matches any already-aliased outgoing connection.  If it
		 does, the packet is altered accordingly.  If not, all
		 -redirect_port, -redirect_proto and -redirect_address assign-
		 ments are checked and actioned.  If no other action can be
		 made and if -deny_incoming is not specified, the packet is
		 delivered to the local machine using the rules specified in
		 -target_address option below.

Код: Выделить всё

     if nic  Use ip addres of NIC for aliasing, dynamically changing it if
	     NIC's ip address change.

Код: Выделить всё

     -interface | -n interface
		 Use interface to determine the aliasing address.  If there is
		 a possibility that the IP address associated with interface
		 may change, the -dynamic option should also be used.  If this
		 option is not specified, the -alias_address option must be
		 used.

Код: Выделить всё

     log     Enable logging on this nat instance.

Код: Выделить всё

     -log | -l	 Log various aliasing statistics and information to the file
		 /var/log/alias.log.  This file is truncated each time natd is
		 started.

Код: Выделить всё

     deny_in
	     Deny any incoming connection from outside world.

Код: Выделить всё

     -deny_incoming | -d
		 Do not pass incoming packets that have no entry in the inter-
		 nal translation table.

		 If this option is not used, then such a packet will be
		 altered using the rules in -target_address below, and the
		 entry will be made in the internal translation table.

Код: Выделить всё

     same_ports
	     Try to leave the alias port numbers unchanged from the actual
	     local port numbers.

Код: Выделить всё

     -same_ports | -m
		 Try to keep the same port number when altering outgoing pack-
		 ets.  With this option, protocols such as RPC will have a
		 better chance of working.  If it is not possible to maintain
		 the port number, it will be silently changed as per normal.

Код: Выделить всё

     unreg_only
	     Traffic on the local network not originating from an unregistered
	     address spaces will be ignored.

Код: Выделить всё

     -unregistered_only | -u
		 Only alter outgoing packets with an unregistered source
		 address.  According to RFC 1918, unregistered source
		 addresses are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.

Код: Выделить всё

     reset   Reset table of the packet aliasing engine on address change.

Код: Выделить всё

     reverse
	     Reverse the way libalias handles aliasing.

Код: Выделить всё

     -reverse	 This option makes natd reverse the way it handles
		 ``incoming'' and ``outgoing'' packets, allowing it to operate
		 on the ``internal'' network interface rather than the
		 ``external'' one.

		 This can be useful in some transparent proxying situations
		 when outgoing traffic is redirected to the local machine and
		 natd is running on the internal interface (it usually runs on
		 the external interface).

Код: Выделить всё

     proxy_only
	     Obey transparent proxy rules only, packet aliasing is not per-
	     formed.

Код: Выделить всё

     -proxy_only
		 Force natd to perform transparent proxying only.  Normal
		 address translation is not performed.

Код: Выделить всё

    redirect_addr

Код: Выделить всё

     -redirect_address localIP publicIP
		 Redirect traffic for public IP address to a machine on the
		 local network.  This function is known as static NAT.	Nor-
		 mally static NAT is useful if your ISP has allocated a small
		 block of IP addresses to you, but it can even be used in the
		 case of single address:

		       redirect_address 10.0.0.8 0.0.0.0

		 The above command would redirect all incoming traffic to
		 machine 10.0.0.8.

		 If several address aliases specify the same public address as
		 follows

		       redirect_address 192.168.0.2 public_addr
		       redirect_address 192.168.0.3 public_addr
		       redirect_address 192.168.0.4 public_addr

		 the incoming traffic will be directed to the last translated
		 local address (192.168.0.4), but outgoing traffic from the
		 first two addresses will still be aliased to appear from the
		 specified public_addr.

Код: Выделить всё

    redirect_port

Код: Выделить всё

     -redirect_port proto targetIP:targetPORT[-targetPORT]
		 [aliasIP:]aliasPORT[-aliasPORT]
		 [remoteIP[:remotePORT[-remotePORT]]]
		 Redirect incoming connections arriving to given port(s) to
		 another host and port(s).  Argument proto is either tcp or
		 udp, targetIP is the desired target IP address, targetPORT is
		 the desired target port number or range, aliasPORT is the
		 requested port number or range, and aliasIP is the aliasing
		 address.  Arguments remoteIP and remotePORT can be used to
		 specify the connection more accurately if necessary.  If
		 remotePORT is not specified, it is assumed to be all ports.

		 Arguments targetIP, aliasIP and remoteIP can be given as IP
		 addresses or as hostnames.  The targetPORT, aliasPORT and
		 remotePORT ranges need not be the same numerically, but must
		 have the same size.  When targetPORT, aliasPORT or remotePORT
		 specifies a singular value (not a range), it can be given as
		 a service name that is searched for in the services(5) data-
		 base.

		 For example, the argument

		       tcp inside1:telnet 6666

		 means that incoming TCP packets destined for port 6666 on
		 this machine will be sent to the telnet port on the inside1
		 machine.

		       tcp inside2:2300-2399 3300-3399

		 will redirect incoming connections on ports 3300-3399 to host
		 inside2, ports 2300-2399.  The mapping is 1:1 meaning port
		 3300 maps to 2300, 3301 maps to 2301, etc.

Код: Выделить всё

    redirect_proto

Код: Выделить всё

     -redirect_proto proto localIP [publicIP [remoteIP]]
		 Redirect incoming IP packets of protocol proto (see
		 protocols(5)) destined for publicIP address to a localIP
		 address and vice versa.

		 If publicIP is not specified, then the default aliasing
		 address is used.  If remoteIP is specified, then only packets
		 coming from/to remoteIP will match the rule.

3 подсети, 2 выхода на внешку (с выходом через впн + локалка прова).