131183SpeterThese are Instructions for Configuring A FreeBSD Box For NAT 231183SpeterAfter you have installed IP-Filter. 331183Speter 431183SpeterYou will need to change three files: 531183Speter 631183Speter/etc/rc.local 731183Speter/etc/sysconfig 831183Speter/etc/natrules 931183Speter 1031183SpeterYou will have to: 1131183Speter 1231183Speter1) Load the kernel module 1331183Speter2) Make the ipnat rules 1431183Speter3) Load the ipnat rules 1531183Speter4) Enable routing between interfaces 1631183Speter5) Add static routes for the subnet ranges 1731183Speter6) Configure your network interfaces 1831183Speter7) reboot the computer for the changes to take effect. 1931183Speter 2031183SpeterThe FAQ was written by Chris Coleman <chris@@bbcc.ctc.edu> 2131183SpeterThis was tested using ipfilter 3.1.4 and FreeBSD 2.1.6-RELEASE 2231183Speter_________________________________________________________ 2331183Speter1) Loading the Kernel Module 2431183Speter 2531183SpeterIf you are using a Kernal Loadable Module you need to edit your 2631183Speter/etc/rc.local file and load the module at boot time. 2731183Speteruse the line: 2831183Speter 2931183Speter modload /lkm/if_ipl.o 3031183Speter 3131183SpeterIf you are not loading a kernel module, skip this step. 3231183Speter_________________________________________________________ 3331183Speter2) Setting up the NAT Rules 3431183Speter 3531183SpeterMake a file called /etc/natrules 3631183Speterput in the rules that you need for your system. 3731183Speter 3831183SpeterIf you want to use the whole 10 Network. Try: 3931183Speter 4031183Spetermap fpx0 10.0.0.0/8 -> 208.8.0.1/32 portmap tcp/udp 10000:65000 4131183Speter 4231183Speter_________________________________________________________ 4331183SpeterHere is an explaination of each part of the command: 4431183Speter 4531183Spetermap starts the command. 4631183Speter 4731183Speterfpx0 is the interface with the real internet address. 4831183Speter 4931183Speter10.0.0.0 is the subnet you want to use. 5031183Speter 5131183Speter/8 is the subnet mask. ie 255.0.0.0 5231183Speter 5331183Speter208.8.0.1 is the real ip address that you use. 5431183Speter 5531183Speter/32 is the subnet mask 255.255.255.255, ie only use this ip address. 5631183Speter 5731183Speterportmap tcp/udp 10000:65000 5831183Speter tells it to use the ports to redirect the tcp/udp calls through 5931183Speter 6031183Speter 6131183SpeterThe one line should work for the whole network. 6231183Speter_________________________________________________________ 6331183Speter3) Loading the NAT Rules: 6431183Speter 6531183SpeterThe NAT Rules will need to be loaded every time the computer 6631183Speterreboots. 6731183Speter 6831183SpeterIn your /etc/rc.local put the line: 6931183Speter 7031183Speteripnat -f /etc/natrules 7131183Speter 7231183SpeterTo check and see if it is loaded, as root type 7331183Speter ipnat -ls 7431183Speter_________________________________________________________ 7531183Speter4) Enable Routing between interfaces. 7631183Speter 7731183SpeterTell the kernel to route these addresses. 7831183Speter 7931183Speterin the rc.local file put the line: 8031183Speter 8131183Spetersysctl -w net.inet.ip.forwarding=1 8231183Speter 8331183Speter_________________________________________________________ 8431183Speter5) Static Routes to Subnet Ranges 8531183Speter 8631183SpeterNow you have to add a static routes for the subnet ranges. 8731183SpeterEdit your /etc/sysconfig to add them at bootup. 8831183Speter 8931183Speterstatic_routes="foo" 9031183Speterroute_foo="10.0.0.0 -netmask 0xf0000000 -interface 10.0.0.1" 9131183Speter 9231183Speter 9331183Speter_________________________________________________________ 9431183Speter6) Make sure that you have your interfaces configured. 9531183Speter 9631183SpeterI have two Intel Ether Express Pro B cards. 9731183SpeterOne is on 208.8.0.1 The other is on 10.0.0.1 9831183Speter 9931183SpeterYou need to configure these in the /etc/sysconfig 10031183Speter 10131183Speternetwork_interfaces="fxp0 fxp1" 10231183Speterifconfig_fxp0="inet 208.8.0.1 netmask 255.255.255.0" 10331183Speterifconfig_fxp1="inet 10.0.0.1 netmask 255.0.0.0" 10431183Speter_________________________________________________________ 105