1*0Sstevel@tonic-gateConfiguring NAT on your network. 2*0Sstevel@tonic-gate================================ 3*0Sstevel@tonic-gate 4*0Sstevel@tonic-gateTo start setting up NAT, we need to define which is your "internal" interface 5*0Sstevel@tonic-gateand which is your "external" interface. The "internal" interface is the 6*0Sstevel@tonic-gatenetwork adapter connected to the network with private IP addresses which 7*0Sstevel@tonic-gateyou need to change for communicating on the Internet. The "external" 8*0Sstevel@tonic-gateinterface is configured with a valid internet address. 9*0Sstevel@tonic-gate 10*0Sstevel@tonic-gateFor example, your internal interface might have an IP# of 10.1.1.1 and be 11*0Sstevel@tonic-gateconnected to your ethernet, whilst your external interface might be a PPP 12*0Sstevel@tonic-gateconnection with an IP number of 204.51.62.176. 13*0Sstevel@tonic-gate 14*0Sstevel@tonic-gateThus your network might look like this: 15*0Sstevel@tonic-gate 16*0Sstevel@tonic-gate<Internal Network> 17*0Sstevel@tonic-gate [pc] [pc] 18*0Sstevel@tonic-gate | | 19*0Sstevel@tonic-gate+-+---------+------+ 20*0Sstevel@tonic-gate | 21*0Sstevel@tonic-gate [firewall] 22*0Sstevel@tonic-gate | 23*0Sstevel@tonic-gate | 24*0Sstevel@tonic-gate Internet 25*0Sstevel@tonic-gate<External Network> 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate 28*0Sstevel@tonic-gateWriting the map-rule. 29*0Sstevel@tonic-gate--------------------- 30*0Sstevel@tonic-gateWhen you're connected to the Internet, you will either have a block of IP 31*0Sstevel@tonic-gateaddresses assigned to you, maybe several different blocks, or you use a 32*0Sstevel@tonic-gatesingle IP address, i.e. with dialup PPP. If you have a block of addresses 33*0Sstevel@tonic-gateassigned, these can be used to create either a 1:1 mapping (if you have 34*0Sstevel@tonic-gateonly a few internal IP addresses) or N:1 mappings, where groups of internal 35*0Sstevel@tonic-gateaddresses map to a single IP address and unless you have enough Internet 36*0Sstevel@tonic-gateaddresses for a 1:1 mapping, you will want to do "portmapping" for TCP and 37*0Sstevel@tonic-gateUDP port numbers. 38*0Sstevel@tonic-gate 39*0Sstevel@tonic-gateFor an N:1 situation, you might have: 40*0Sstevel@tonic-gate 41*0Sstevel@tonic-gatemap ppp0 10.1.0.0/16 -> 209.23.1.5/32 portmap tcp/udp 10000:40000 42*0Sstevel@tonic-gatemap ppp0 10.1.0.0/16 -> 209.23.1.5/32 portmap 43*0Sstevel@tonic-gate 44*0Sstevel@tonic-gatewhere if you had 16 addresses available, you could do: 45*0Sstevel@tonic-gate 46*0Sstevel@tonic-gatemap ppp0 10.1.0.0/16 -> 209.23.1.0/28 portmap tcp/udp 10000:40000 47*0Sstevel@tonic-gatemap ppp0 10.1.0.0/16 -> 209.23.1.0/28 portmap 48*0Sstevel@tonic-gate 49*0Sstevel@tonic-gateOr if you wanted to allocate subnets to each IP#, you might do: 50*0Sstevel@tonic-gate 51*0Sstevel@tonic-gatemap ppp0 10.1.1.0/24 -> 209.23.1.2/32 portmap tcp/udp 10000:40000 52*0Sstevel@tonic-gatemap ppp0 10.1.2.0/24 -> 209.23.1.3/32 portmap tcp/udp 10000:40000 53*0Sstevel@tonic-gatemap ppp0 10.1.3.0/24 -> 209.23.1.4/32 portmap tcp/udp 10000:40000 54*0Sstevel@tonic-gatemap ppp0 10.1.1.0/24 -> 209.23.1.2/32 portmap 55*0Sstevel@tonic-gatemap ppp0 10.1.2.0/24 -> 209.23.1.3/32 portmap 56*0Sstevel@tonic-gatemap ppp0 10.1.3.0/24 -> 209.23.1.4/32 portmap 57*0Sstevel@tonic-gate 58*0Sstevel@tonic-gate*** NOTE: NAT rules are used on a first-match basis only! 59*0Sstevel@tonic-gate 60*0Sstevel@tonic-gate 61*0Sstevel@tonic-gateFiltering with NAT. 62*0Sstevel@tonic-gate------------------- 63*0Sstevel@tonic-gateIP Filter will always translate addresses in a packet _BEFORE_ it checks its 64*0Sstevel@tonic-gateaccess list for inbound packets and translates addresses _AFTER_ it has 65*0Sstevel@tonic-gatechecked the access control lists for outbound packets. 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gateFor example (using the above NAT rules), if you wanted to prevent all hosts 68*0Sstevel@tonic-gatein the 10.1.2.0/24 subnet from using NAT, you might use the following rule 69*0Sstevel@tonic-gatewith ipf: 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gateblock out on ppp0 from 10.1.2.0/24 to any 72*0Sstevel@tonic-gateblock in on ppp0 from any to 10.1.2.0/24 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gateand use these with ipnat: 75*0Sstevel@tonic-gate 76*0Sstevel@tonic-gatemap ppp0 10.1.0.0/16 -> 209.23.1.0/28 portmap tcp/udp 10000:40000 77*0Sstevel@tonic-gatemap ppp0 10.1.0.0/16 -> 209.23.1.0/28 portmap 78