# nat rule for one-to-one IP address mapping



## keshav (Oct 2, 2013)

Looks like I'm missing a syntax for the ipfw NAT rule. I would appreciate if someone familiar with ipfw can help with this.

I'm setting up ipfw NAT for one-to-one translation within a lab environment. Simply put, I need the source IP originating from the (external) client to change to an internal IP, which should get forwarded to an internal server.

That is, something like:

External client -> ipfw/NAT (freebsd FreeBSD 8.4/amd64) -> HTTP server
(50.1.2.3 -> 50.1.2.6 <ipfw/NAT mapping> 3.0.21.7 -> 3.0.21.6)

I have the following configurations in place and the NAT rule appears to have loaded (as can be seen below) but I don't see the IP translation taking place:

I have built a custom kernel with the following options:


```
options         IPFIREWALL
options         IPFIREWALL_NAT
options         IPFIREWALL_FORWARD
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_DEFAULT_TO_ACCEPT
options         IPDIVERT
options         IPFILTER
options         IPFILTER_LOG
options         LIBALIAS
options         DUMMYNET
```

/etc/rc.conf has the following:


```
sshd_enable="YES"
gateway_enable="YES"

firewall_enable="YES"
firewall_script="/usr/local/etc/ipfw.rules"
firewall_logging="YES"
firewall_type="open"

natd_enable="YES"
natd_interface="em1"
natd_flags="-f /etc/natd.conf"
```
and the relevant rules in /usr/local/etc/ipfw.rules:


```
ipfw add 500 nat 1 all from any to any via em1
ipfw nat 1 config redirect_addr 3.0.21.7 50.1.2.6
```

(3.0.21.7 is the internal IP. 50.1.2.6 is the external client).

And /etc/natd.conf


```
# NATd options
use_sockets
same_ports
interface em1
redirect_address 3.0.21.7 50.1.2.6
```

And finally, it appears ipfw has enabled the rule:


```
# /etc/rc.d/ipfw start
00500 nat 1 ip from any to any via em1
ipfw nat 1 config redirect_addr 3.0.21.7 50.1.2.6
Firewall rules loaded.
Firewall logging enabled.
Starting natd.
#
```


```
# ps auxwww|grep nat
root   2362  0.0  0.2 14132  1628  ??  Is    7:04AM   0:00.00 /sbin/natd -f /etc/natd.conf -n em1
#
```

So the daemon is running.

Finally,


```
# uname -mrs
FreeBSD 8.4-RELEASE amd64
#
```

What am I missing?


----------

