Ubuntu Manpage: sanewall-nat, sanewall-snat, sanewall-dnat, sanewall-redirect

Provided by: sanewall-doc_1.0.2+ds-2_all

NAME

       sanewall-nat, sanewall-snat, sanewall-dnat, sanewall-redirect - set up NAT and port redirections

SYNOPSIS


       snat [to] target [rule-params]

       dnat [to] target [rule-params]

       redirect [to] portrange [rule-params]

       nat {to-source | to-destination | redirect-to} target [rule-params]

       nat redirect-to portrange [rule-params]

DESCRIPTION

Note

The rule-params are used only to determine the traffic that will be matched for NAT in these
commands.

snat
The snat helper sets up a Source NAT rule for routed traffic by calling nat to-source. For example:

snat to 192.0.2.1 outface eth0 src 198.51.100.1 dst 203.0.113.1

dnat
The dnat helper sets up a Destination NAT rule for routed traffic by calling nat to-destination. For
example:

dnat to 192.0.2.1 outface eth0 src 198.51.100.1 dst 203.0.113.1

redirect
The redirect helper redirects matching traffic to portrange on the local host by calling nat redirect-to.
For example:

redirect-to 8080 inface eth0 src 198.51.100.0/24 proto tcp dport 80

nat
The nat helper takes one of the following sub-commands:

to-source target
Defines a Source NAT (created in table NAT, chain POSTROUTING).

target is the source address to be set in packets matching rule-params.

If no rules are given, all forwarded traffic will be matched. inface should not be used in SNAT
since the information is not available at the time the decision is made.

target accepts any --to-source values that iptables(8) accepts. Run iptables -j SNAT --help to for
more information. Multiple targets may be specified by separating with spaces and enclosing with
quotes.

to-destination target
Defines a Destination NAT (created in table NAT, chain POSTROUTING).

target is the destination address to be set in packets matching rule-params.

If no rules are given, all forwarded traffic will be matched. outface should not be used in DNAT
since the information is not available at the time the decision is made.

target accepts any --to-destination values that iptables(8) accepts. Run iptables -j DNAT --help to
for more information. Multiple targets may be specified by separating with spaces and enclosing with
quotes.

redirect-to portrange
Redirect matching traffic to the local machine (created in table NAT, chain PREROUTING).

portrange is the port range (from-to) or single port that packets matching rule-params will be
redirected to.

If no rules are given, all forwarded traffic will be matched. outface should not be used in REDIRECT
since the information is not available at the time the decision is made.

EXAMPLES

           # Send to 192.0.2.1
           #  - all traffic arriving at or passing through the firewall
           nat to-destination 192.0.2.1

           # Send to 192.0.2.1
           #  - all traffic arriving at or passing through the firewall
           #  - which WAS going to 203.0.113.1
           nat to-destination 192.0.2.1 dst 203.0.113.1

           # Send to 192.0.2.1
           #  - TCP traffic arriving at or passing through the firewall
           #  - which WAS going to 203.0.113.1
           nat to-destination 192.0.2.1 proto tcp dst 203.0.113.1

           # Send to 192.0.2.1
           #  - TCP traffic arriving at or passing through the firewall
           #  - which WAS going to 203.0.113.1, port 25
           nat to-destination 192.0.2.1 proto tcp dport 25 dst 203.0.113.1

           # Other examples
           nat to-source 192.0.2.1 outface eth0 src 198.51.100.1 dst 203.0.113.1
           nat to-destination 192.0.2.2 outface eth0 src 198.51.100.2 dst 203.0.113.2
           nat redirect-to 8080 inface eth0 src 198.51.100.0/24 proto tcp dport 80

AUTHOR

       Sanewall Team

COPYRIGHT