# natd and 2 instances



## Twister (Dec 7, 2011)

Hello!

Does anybody know, can natd serve two instances at the same time? I have xl0 connected to the provider's internal network and ng0 (mpd5, pptp) connection to Internet. pptp connection made over network on xl0 interface. Now I have natd working on ng0 - to use internet resources. And I want to use resources from provider's network - I need another NAT on xl0.

What I have to do - use another instance in natd or use another NAT - ngNAT or ipfw nat?


----------



## Anonymous (Dec 7, 2011)

Twister said:
			
		

> ... I have natd working on ng0 - to use internet resources ...



Are you really sure, that you need NAT for this?

IMHO, the net/mpd5 bundle setting 
	
	



```
set iface enable proxy-arp
```
 should do the trick. You need also to add the following lines to /etc/sysctl.conf if you don't have done this already:

```
net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1
```

Best reagards

Rolf


----------



## phoenix (Dec 7, 2011)

You can run as many natd instances as you want, so long as the port they listen on is different, and you write your IPFW rules to use the correct port when diverting packets to natd.

I have some firewalls with 32+ natd instances running (multiple 1:1 NAT setups for servers in the DMZ, plug many:1 NAT for LAN systems).


----------



## Crest (Dec 8, 2011)

Are their any advantages in running natd instead of in-kernel NAT?


----------



## phoenix (Dec 8, 2011)

Not anymore.  We're still running natd mainly due to inertia, as these firewalls started with FreeBSD 4.x.

Prior to FreeBSD 8-ish, libalias (used by PPP NAT and in-kernel NAT) didn't support all the same features as natd.  Now, there's very few regularly-used features missing from libalias, so you can use "ipfw nat" pretty much everywhere you used "ipfw diver" + natd.


----------



## Twister (Dec 8, 2011)

rolfheinrich said:
			
		

> Are you really sure, that you need NAT for this?



I didn't say - it's a router used to access the internet from a private network.


----------

