IPNAT(5)

NAME
ipnat, ipnat.conf - IP NAT file format

DESCRIPTION
The format for files accepted by ipnat is described by the following grammar:

ipmap :: = mapit ifname ipmask "->" ipmask [ mapport ] .
mapit ::= "map" | "rdr" .
ipmask ::= ip "/" bits | ip "/" mask | ip "netmask" mask .
mapport ::= "portmap" tcpudp portnumber ":" portnumber .
tcpudp ::= "tcp" | "udp" | "tcp/udp" .
portnumber ::= number { numbers } .
ifname ::= 'A' - 'Z' { 'A' - 'Z' } numbers .
numbers ::= '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9' .

For standard NAT functionality, a rule should start with map and then proceeds to specify the interface for which outgoing packets will have their source address rewritten.

Packets which will be rewritten can only be selected by matching the original source address. A netmask must be specified with the IP address.

The address selected for replacing the original is chosen from an IP#/netmask pair. A netmask of all 1's indicating a hostname is valid. A netmask of 31 1's (255.255.255.254) is considered invalid as there is no space for allocating host IP#'s after consideration for broadcast and network addresses.

When remapping TCP and UDP packets, it is also possible to change the source port number. Either TCP or UDP or both can be selected by each rule, with a range of port numbers to remap into given as port-number:port-number.

Examples

To change IP#'s used internally from network 10 into an ISP provided 8 bit subnet at 209.1.2.0, the following would be used:

map 10.0.0.0/8 -> 209.1.2.0/24

The obvious problem here is we're trying to squeeze over 16,000,000 IP addresses into a 254 address space. To increase the scope, remapping for TCP and/or UDP, port remapping can be used;

map 10.0.0.0/8 -> 209.1.2.0/24 portmap tcp/udp 1025:65000

which falls only 527,566 `addresses' short of the space available in network 10. If we were to combine these rules, they would need to be specified as follows:

map 10.0.0.0/8 -> 209.1.2.0/24 portmap tcp/udp 1025:65000
map 10.0.0.0/8 -> 209.1.2.0/24

so that all TCP/UDP packets were port mapped and only other protocols, such as ICMP, only have their IP# changed.

FILES
/dev/ipnat
/etc/services
/etc/hosts
/usr/share/examples/ipf Directory with examples.

SEE ALSO
ipnat(4), hosts(5), ipf(5), services(5), ipf(8), ipnat(8)