


IPNAT(5)                                                 IPNAT(5)


NAME
       ipnat - IP NAT file format

DESCRIPTION
       The format for files accepted by ipnat is described by the
       following grammar:

       ipmap :: = mapblock | redir | map .

       map ::= mapit ifname ipmask "->" ipmask [ mapport ] .
       mapblock ::= "map-block" ifname ipmask "->" ipmask [ ports ] .
       redir ::= "rdr" ifname [ fromspec ] ipmask "->" ip [ ports ] [ tcpudp ] .
       ports ::= "ports" numports | "auto" .
       mapit ::= "map" | "bimap" .
       ipmask ::= ip "/" bits | ip "/" mask | ip "netmask" mask .
       mapport ::= "portmap" tcpudp portnumber ":" portnumber .

       fromspec ::= "from" ip "/" ipmask .
       tcpudp ::= "tcp" | "udp" | "tcp/udp" .
       portnumber ::= number { numbers } | "auto" .
       ifname ::= 'A' - 'Z' { 'A' - 'Z' } numbers .

       numbers ::= '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9' .

       For standard NAT functionality, a rule should  start  with
       map  and  then proceeds to specify the interface for which
       outgoing packets will have their source address rewritten.

       Packets  which  will  be rewritten can only be selected by
       matching the original source address.  A netmask  must  be
       specified with the IP address.

       The  address selected for replacing the original is chosen
       from an IP#/netmask pair.  A netmask of all 1's indicating
       a    hostname   is   valid.    A   netmask   of   31   1's
       (255.255.255.254) is considered invalid  as  there  is  no
       space  for  allocating  host IP#'s after consideration for
       broadcast and network addresses.

       When remapping TCP and UDP packets, it is also possible to
       change  the source port number.  Either TCP or UDP or both
       can be selected by each rule, with a range of port numbers
       to remap into given as port-number:port-number.

COMMANDS
       There  are  four  commands  recognised  by IP Filter's NAT
       code:

       map    that is used for mapping one address or network  to
              another in an unregulated round robin fashion;

       rdr    that  is  used  for  redirecting  packets to one IP
              address and port pair to another;




                                                                1





IPNAT(5)                                                 IPNAT(5)


       bimap  for setting up bidirectional NAT between an  exter-
              nal IP address and an internal IP address and

       map-block
              which  sets up static IP address based translation,
              based on a algorithm to squeeze the addresses to be
              translated into the destination range.

MATCHING
       For basic NAT and redirection of packets, the address sub-
       ject to change is used along with its protocol to check if
       a  packet should be altered.  In the case of redirects, it
       is also possible to select packets  on  a  source  address
       basis  using  the  from  keyword, as well as the manditory
       destination port.  The packet matching part of the rule is
       to the left of the "->" in each rule.

TRANSLATION
       To  the right of the "->" is the address and port specifi-
       caton which will be written into the packet  providing  it
       has already successful matched the prior constraints.  The
       case of redirections (rdr) is the simpliest: the new  des-
       tination  address  is that specified in the rule.  For map
       rules, the destination address will be one for  which  the
       tuple combining the new source and destination is known to
       be unique.  If the packet is either a TCP or  UDP  packet,
       the  destination  and  source ports come into the equation
       too.  If the tuple already exists, IP Filter  will  incre-
       ment  the  port  number  first, within the available range
       specified with portmap  and  if  there  exists  no  unique
       tuple,  the  source address will be incremented within the
       specified netmask.  If a unique  tuple  cannot  be  deter-
       mined,  then  the packet will not be translated.  The map-
       block is more limited in how it searches for a  new,  free
       and  unique  tuple,  in  that it will used an algorithm to
       determine what the new source  address  should  be,  along
       with  the  range  of  available  ports - the IP address is
       never changed and nor does the port number ever exceed its
       alloted range.

KERNEL PROXIES
       IP Filter comes with a few, simple, proxies built into the
       code that is loaded into the  kernel  to  allow  secondary
       channels  to be opened without forcing the packets through
       a user program.

TRNSPARENT PROXIES
       True transparent proxying should be  performed  using  the
       redirect   (rdr)   rules   directing  ports  to  localhost
       (127.0.0.1) with the proxy program doing a lookup  through
       /dev/ipnat to determine the real source and address of the
       connection.





                                                                2





IPNAT(5)                                                 IPNAT(5)


EXAMPLES
       This section deals with the map command  and  it's  varia-
       tions.

       To  change  IP#'s  used internally from network 10 into an
       ISP provided 8 bit subnet at 209.1.2.0  through  the  ppp0
       interface, the following would be used:

       map ppp0 10.0.0.0/8 -> 209.1.2.0/24

       The  obvious  problem here is we're trying to squeeze over
       16,000,000 IP addresses into  a  254  address  space.   To
       increase  the  scope,  remapping  for TCP and/or UDP, port
       remapping can be used;

       map ppp0 10.0.0.0/8 -> 209.1.2.0/24 portmap tcp/udp 1025:65000

       which falls only 527,566 `addresses' short  of  the  space
       available  in  network  10.   If  we were to combine these
       rules, they would need to be specified as follows:

       map ppp0 10.0.0.0/8 -> 209.1.2.0/24 portmap tcp/udp 1025:65000
       map ppp0 10.0.0.0/8 -> 209.1.2.0/24

       so that all TCP/UDP packets  were  port  mapped  and  only
       other  protocols,  such  as  ICMP,  only  have  their  IP#
       changed.  In some instaces, it is more appropriate to  use
       the  keyword auto in place of an actual range of port num-
       bers if you want to guarantee simultaneous access  to  all
       within  the  given  range.  However, in the above case, it
       would default to 1 port per IP address, since we  need  to
       squeeze  24  bits of address space into 8.  A good example
       of how this is used might be:

       map ppp0 172.192.0.0/16 -> 209.1.2.0/24 portmap tcp/udp auto

       which would result in each IP address being given a  small
       range of ports to use (252).  The problem here is that the
       map  directive  tells  the  NAT  code  to  use  the   next
       address/port  pair  available  for an outgoing connection,
       resulting in no easily discernable relation between exter-
       nal  addresses/ports  and internal ones.  This is overcome
       by using map-block as follows:

       map-block ppp0 172.192.0.0/16 -> 209.1.2.0/24 ports auto

       For example, this would  result  in  172.192.0.0/24  being
       mapped to 209.1.2.0/32 with each address, from 172.192.0.0
       to 172.192.0.255 having 252 ports of its own.  As  opposed
       to  the  above  use of map, if for some reason the user of
       (say)  172.192.0.2  wanted  260  simultaneous  connections
       going out, they would be limited to 252 with map-block but
       would just move on to the next IP  address  with  the  map
       command.  /dev/ipnat



                                                                3





IPNAT(5)                                                 IPNAT(5)


       /etc/services
       /etc/hosts

SEE ALSO
       ipnat(4), hosts(5), ipf(5), services(5), ipf(8), ipnat(8)




















































                                                                4


