Hello!
Please test: http://antigreen.org/vadim/freebsd/ng_nat/ (I've ran for a
week on a production 6.2 router without any problems).
This is a patched version of ng_nat(4) for FreeBSD 6.x, providing support
for all libalias(3) features, especially port redirections (before this
moment ng_nat(4) has supported only the basic functionality of the
library).
To compile kernel module:
$ make
To load it into the running kernel:
$ kldload ./ng_nat.ko
To view the man page documenting new messages:
$ tbl ng_nat.4 | nroff -man | more
There is also included a convenient rcNG-style boot script, ng_nat.sh,
which allows to easily configure ng_nat(4) nodes and ipfw(8) from
rc.conf(5).
It is based on a Eugene Grosbein's version and heavily modified by me.
Example for two nodes from /etc/rc.conf:
ng_nat_nodes="simple full" # list of node names
# Simple example - all we need is only three lines
ng_nat_simple_interface="em1" # take IP addr from "em1"
ng_nat_simple_cookies="50 51" # ipfw's "netgraph"
arguments, "in" then
"out"
ng_nat_simple_ipfw_rules="80 90" # ipfw rule numbers to create,
"in" then
"out"
# More complex example, in which we need custom ipfw(8) rules for several
# selected networks (default rule will catch all) and setup some
redirections.
ng_nat_full_interface="1.2.3.4" # external alias address
ng_nat_full_cookies="60 61"
# for custom rules these numbers are used only for deletion on shutdown;
# these can duplicate and be more than two
ng_nat_full_ipfw_rules="172 172 182"
# Actual custom rules - if not defined, rules are created automatically
ng_nat_full_ipfw_rule0="172 netgraph 60 ip from 172.16.0.0/25 to any out
xmit em0"
ng_nat_full_ipfw_rule1="172 netgraph 60 ip from 172.16.0.128/27 to any out
xmit em0"
ng_nat_full_ipfw_rule2="182 netgraph 61 ip from any to 1.2.3.4 in recv
em0"
# Set natd(8)-like flags for node (if not specified, node uses
"same_ports")
# Available flags are: log, deny_incoming, same_ports, unregistered_only,
# proxy_only, reverse, reset_on_addr_change. The last is new and means that
# after aliasing address change internal table should be cleared (breaks
# current connections like node restart).
ng_nat_full_set_mode="same_ports unregistered_only"
# Set target address for any unspecified incoming traffic, like "natd
-t"
ng_nat_full_set_target="172.16.0.100"
# Set up several redirection rules, each can have an optional description
# string of up to 63 chars in length. DNS hostnames are disallowed.
# natd(8) -redirect_port
ng_nat_full_redirect_port0="tcp 172.16.0.1:22 222"
ng_nat_full_redirect_port1="udp 172.16.0.2:2300-2399 3300-3399"
ng_nat_full_redirect_port1_description="For P2P and VoIP apps"
ng_nat_full_redirect_port2="tcp
172.16.0.101:80,172.16.0.102:80,172.16.0.103:80 1.2.3.4:80"
# -redirect_proto and -redirect_address (including LSNAT) can be
# specified the same way, if needed, as long as -proxy_rule.
The script also supports additional command-line keywords, along with
standard
"start" and "stop" ones. They include
"redirect_port", "redirect_proto" and
"redirect_address", along with "list_redirects". The format
is:
$ /path/to/ng_nat.sh <keyword> <node_name> [arguments]
e.g.
$ /etc/rc.d/ng_nat.sh redirect_port full tcp 172.16.0.8:80 8080
This allows to add redirections "on the fly" without need to restart
entire
node breaking current connections.
The "list_redirects" keyword prints table of all redirects (no matter
what
type) in a pretty human-readable format. This can be used to obtain ID of
specific redirection to make it dynamic or delete it "on the fly":
$ ngctl msg full: redirectdelete 3 # delete redirection with ID
number 3
Enjoy! ;-)
--
WBR, Vadim Goncharov