Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to setup a basic NAT server. I want all traffic coming from the outside world to the NAT server to be redirected to another machine, where I have a lipcap service running to parse this traffic.

I tried -redirect_port and -redirect_address in the natd_flags part in rc.conf but nothing works...any thoughts?

share|improve this question

2 Answers 2

Userspace natd needs ipfw enabled. IPFW catch packets and redirect them to the natd that translate addresses. But nowaday you can use kernel nat embedded into ipfw.

Let's enable IPFW engine

# /etc/rc.conf
. . . . .
gateway_enable="YES"
firewall_enable="YES"
firewall_nat_enable="YES"
firewall_script="/etc/rc.ipfw"
. . . . .

And let's configure kernel redirection:

# /etc/rc.ipfw
. . . . .
oip="1.2.3.4"   # Outer IP looking to the internet
tip="10.0.0.100 # Target host
ipfw nat 1 config redirect_addr ${tip} ${oip}
. . . . . 

That's all.

share|improve this answer
    
Thanks a lot. I tried this rule, and added several other after it to allow traditional traffic. It doesn’t work as I expected. Several things that I am not sure about. 1- should this rule show up when i use 'ipfw list' because it doesnt for me? 2- The NAT machine acts as a gateway so I want it to be able to DNS and what not without redirection. Any thoughts? –  nawar Dec 26 '13 at 8:27

The PF firewall has NAT and redirection build right in. Add this to /etc/rc.conf:

gateway_enable="YES"
pf_enable="YES"

And configure the firewall. Add these lines to /etc/pf.conf:

ext_if=em0
ext_addr = N.N.N.N  (your external IP)

int_if=em1
int_net=10.0.0.0/8
int_addr=10.0.0.1
libcap_host=10.0.0.2

nat on $ext_if from $int_net to any -> $ext_addr
rdr on $ext_if from any to $ext_addr -> $libcap_host

The NAT rule will do what you expect, send all traffic generated on your internet network to the world via the gateway's external IP. The rdr rule will route all incoming connections to your target host.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.