IPNAT(5)                  OpenBSD Programmer's Manual                 IPNAT(5)

NAME
     ipnat - IP NAT file format

DESCRIPTION
     Files processed by ipnat(8) are normal text files containing either a
     valid NAT rule or a comment on each non-blank line. Comment lines begin
     with a `#' and are ignored, as are blank lines. Valid NAT rules are de-
     scribed by the following grammar:

           natrule     ::= maprule | rdrrule | bimaprule

           maprule     ::= "map" ifname source "->" destination [mapoption]
           rdrrule     ::= "rdr" ifname destination port "->" target
           bimaprule   ::= "bimap" ifname source "->" destination

           source      ::= destination
           destination ::= host "/" mask
           target      ::= host "port" port porttype

           portrange   ::= port ":" port
           portmap     ::= "portmap" porttype portrange
           proxy       ::= "proxy port" port [ "/" protocol ]
           mapoption   ::= proxy | portmap

           porttype    ::= "tcp" | "udp" | "tcpudp" | "tcp/udp"

           protocol    ::= <name from /etc/protocols> | <# from /etc/protocols>
           port        ::= <unsigned 16 bit value> | <name from /etc/services>
           host        ::= 'any' | <IP addr> | <interface name> | <host name>
           mask        ::= <non-numeric> | <IP addr> | <hex value> | <bit count>
           ifname      ::= <interface name>

     Elements in a rule are usually separated by whitespace (blanks or tabs).
     In the case of the `/' in host rule or the `:' in the portrange rule,
     there must be no whitespace before or after it. In the case of the `/' in
     the proxy rule there must be whitespace before but no whitespace after.

     In the host and mask rules, the alternatives are evaluated in the order
     given.

     For the mask rule, if the element begins with a non-digit the mask is
     taken to be all zeros.  A `.' in the element causes the element to be in-
     terpreted as a numeric IP address of the form 1.2.3.4. An `x' in the ele-
     ment causes the element to be interpreted as a 32 bit hex value. If all
     else fails the element is interpreted as the number of sequential 1's to
     place as the most significant bits in the 32 bit network mask.  Whatever
     the interpretation method, a result network mask of all 1's, indicating a
     hostname, is valid.  A network mask of 31 1's (255.255.255.254) is con-
     sidered invalid as there is no space for allocating host IP#'s after con-
     sideration for broadcast and network addresses.

EXAMPLES
     To change IP numbers used internally from network 10 into an ISP provided
     8-bit subnet at 209.1.2.0 through the ppp0 interface, the following would
     be used:

           map ppp0 10.0.0.0/8 -> 209.1.2.0/24

     The obvious problem here is we're trying to squeeze over 16,000,000 IP
     addresses into a 254 address space. To increase the scope, remapping for
     TCP and/or UDP, port remapping can be used:

           map ppp0 10.0.0.0/8 -> 209.1.2.0/24 portmap tcp/udp 1025:65000

     which falls only 527,566 `addresses' short of the space available in net-
     work 10.  If we were to combine these rules, they would need to be speci-
     fied as follows:

           map ppp0 10.0.0.0/8 -> 209.1.2.0/24 portmap tcp/udp 1025:65000
           map ppp0 10.0.0.0/8 -> 209.1.2.0/24

     so that all TCP/ UDP packets were port mapped and other protocols, such
     as ICMP, have only their IP# changed.

     Further examples can be found in the file /use/share/ipf/nat.1

FILES
     /dev/ipnat
     /etc/services
     /etc/protocols
     /etc/hosts
     /usr/share/ipf/nat.1  example rules
     /usr/share/ipf/nat.2  system requirements for use of NAT
     /etc/ipnat.rules      actual rule list

SEE ALSO
     ipf(1),  ipftest(1),  ipf(4),  ipl(4),  ipnat(4),  hosts(5),  ipf(5),
     services(5) protocols(5) ipfstat(8),  ipmon(8),  ipnat(8)

     http://coombs.anu.edu.au/~avalon


OpenBSD 2.6                      June 5, 1999                                2
