NATPT.CONF(5)

NAME
natpt.conf - configuration file for KAME NAT-PT

DESCRIPTION
natpt.conf describes the configuration file format for natptconfig(8). However natptconfig(8) does not have default configuration file, this filename (natpt.conf) is as an example.

This file consists of a sequence of statements. Each statement is beginning with directive. Lines beginning with ‘#’ are comments. Blank line is ignored.

Each rule processed by this translater is added in the kernel internal list if there is no parsing problems. When more than one rule is described, rule that has an error is not added, but the rule that has no error is added to this list.

DIRECTIVES
Keywords and special characters that the parser expects exactly are displayed using this font. Parameters are specified with this font. Square brackets (‘[’ and ‘]’) are used to show optional keywords and parameters. Parentheses (‘(’ and ‘)’) are used to group keywords and parameters when necessary. The vertical bar (‘|’) is used to indicate a choice between optional parameters.

You can put all directives into file and process using -f option (see natptconfig(8)), here we describe directives mainly executed from command line. The following directives are available in the configuration file.

prefix prefix
    Set NAT-PT prefix. Packet addressed to this prefix is subject to translate. Prefix length is always assumed as 96 bits.

    This prefix should be a Global Unicast Addresses. When you specify a link-local or multicast address as a NAT-PT prefix, translator cannot send a translated packet to the network.

map [number]
    from ... Add translation rule into the kernel internal list. The rules for returning packet is not appear in this map list. Rule is arranged with ascending order according to this number. number is number of translation rule. This is a non negative integer and it is supposed to be 65535 when omitted. See the RULE NUMBER section below for more information.

    The following formats are available. With this following examples, all the rule number is omitted.

    map from any6 to v4addr
        [port num - mum]
    map from v6addr
        [/ num] to v4addr [port num - mum] Translate IPv6 packet to IPv4 packet.

        The former is translate IPv6 packet coming from arbitrary host. The latter is translate IPv4 packet coming from specified host or address range. Both rules translate incoming IPv6 packet to packet coming out of specified IPv4 address. The number after / specifies address mask. When address mask is not specified, it is treated as if / 128 is specified. If port is specified, convert source port number into the number that is not used with specified range. If not, source port number is not converted.

    map from
        v4addr [dport num] to v6addr [dport num] Translate IPv4 packet to IPv6 packet.

        This format was changed to the format using daddr/dport. It is recommended not to use this format because this format may be abolished in the future. Use the following rule instead.

    map from daddr v4addr
        to daddr v6addr
    map from daddr v4addr dport v4port
        to daddr v6addr dport v6port Translate IPv4 packet to IPv6 packet.

        The former is translate IPv4 packet destined to specified IPv4 address to IPv6 packet going to specified address. Port number is not changed.

        The latter is translate IPv4 packet destined to v4addr and v4port to IPv6 packet destined to v6addr and v6port. Both rules translate both source and destination address.

    map from v4addr
        [/ num] to v4addr [port num - mum] Translate IPv4 packet to IPv4 packet.

        IPv4 packet coming from specified host or address range is translated to packet coming out of specified IPv4 address. The number after / specifies address mask. When address mask is not specified, it is treated as if / 32 is specified. If port is specified, convert source port number into the number that is not used with specified range. If not, source port number is not converted. This facility (IPv4-IPv4 translation) is same as a lot of NAT used in the world.

    All the rules mentioned above (map from ...) can have [proto protcol] option. This option specifies the protocol, specify icmp tcp and udp separated by ‘/’. For example, proto tcp/udp. There is no meaning in order of protocol to specify, and there is no syntax error when you specify more then one same protocol. This proto option must be specified at the last of syntax except a case of using bidir option.

    Option bidir is used when specified bi-directional NAT. This NAT binds global address to private address one-on-one statically. Sessions can be initiated from hosts in the public network as well as the private network. So, if you can set nat session as bidirectional, you can connect to the host located behind this NAT from public IPv4 network.

    Here are some important points to consider when using bidir option:

    •   This bidir option must be specified at the last of syntax.

    •   Number of address that specify by from and to is 1. You can not specify more than one address here because translation is ono-on-one.

    •   Does not translate port number. So You need several IPv4 address, an equal number of host to be connected to.

    •   It is recommended that the IP address which described after to is set different from IP address assigned to interface of this NAT box. Or NAT can not receive a packet destined to NAT itself because this NAT translate the packet which come to this IP address unconditionally.

        -alias option of ifconfig command is usable to do this purpose. See ifconfig(8) for more detail.

map flush
    Remove all translation rules from the kernel. There is no way to remove only one rule.

map (enable|disable) Enable or disable translation. Initial status is disabled.

set var = value
    Set the value to the variable. Value can use decimal or hexadecimal (begin with 0x) notation. Variables are divided into three categories, ‘tslot’, ‘caddr’ and ‘others’. Description of each category and of variables belonging to it is as follows.

    The following variables are belonging to ‘others’ and are displayed with ‘show variables’ subcommand.

    translation
        The flag which does Protocol translation. If this value is not zero, protocol translation is done. Otherwise, protocol translation is not done. This value is also set by ‘map’ subcommand.
    debug
        This is for debug.
    dump
        When set, dump mbuf or ip packet. You must run natptlog command to show its dump.
    prefix
        NAT-PT prefix. This value is set by ‘prefix’ subcommand.
    forcefragment4
        If set to non-zero value, translator translates ipv4 packet into ipv6 packet even if its DF bit is set and its size exceeds 1260 octets. if ipv4 packet size exceeds 1260 octets, packet is divided into two ipv6 packet with fragment header.

        Because this behavior ignores meaning of DF bit, you had better not use it if possible.
    uselog
        If set to non-zero value, log output goes to natptlog system. You need to invoke natptlog to read this log message
    usesyslog
        If set to non-zero value, log output goes to syslog system. Log facility of this time is LOG_KERNEL. See syslog.conf(5) for more detail. There is no way to distinguish between this message and other message from kernel now.

    The following variables are belonging to ‘caddr’ and are displayed with ‘show variables caddr’ subcommand. You can not set these variables. These are read only and are for debug.

    cSlotHead
        Start address of the configuration table.
    tSlotHead
        Start address of the current translation table.

    The following variables are belonging to ‘tslot’ and are displayed with ‘show variables tslot’ subcommand. These variables are all related with timer, and unit of time is a second.

    “tSlot” is a current translation table and holds an translation information. If translation is disabled or there is no translation, this table size is zero, and this size increases or decreases according to translation process. This table has a time watching process and several valid lifetimes. Time watching process watches every entry of this table and eliminates an entry which exceed its lifetime. Lifetime varies by what kind of protocol this slot translates into. Detail of each lifetime is described below.

    tSlotTimer
        This is a time interval to invoke the time watching process. If set to zero value time-watching-process invokes continuously, it may bear an unexpected result; e.g. translation slot is not registered, and translation never occurs.

        If set to 10 seconds, and lifetime described below is set to 20 seconds, slot entry exists for maximum 30 seconds for minimum 20 seconds.
    maxTTLany
        This is one of lifetime and this is valid when protocol is not a TCP, UDP nor ICMP.
    maxTTLicmp
        This is one of lifetime and is related to ICMP/ICMPv6.
    maxTTLudp
        This is one of lifetime and is related to UDP.
    maxTTLtcp
        This is one of lifetime and is related to TCP and this is valid when status of TCP session is as follows.
        - TCPS_ESTABLISHED
    tcpt_2msl
        This is one of lifetime and is related to TCP and this is valid when status of TCP session is as follows.
        - TCPS_CLOSED
        - TCPS_TIME_WAIT
    tcp_maxidle
        This is one of lifetime and is related to TCP and this is valid when status of TCP session is as follows.
        - TCPS_SYN_SENT
        - TCPS_SYN_RECEIVED
        - TCPS_FIN_WAIT_1
        - TCPS_FIN_WAIT_2
    maxFragment
        This is one of lifetime and is related to fragmented packet. You do not need to change this usually.

    See natptconfig(8) for more detail of the ‘natptconfig show’ subcommand.

RULE NUMBER
Here are some important points to consider when attatching rule number:

•   Rule is arranged with ascending order according to this number. This rule number is a non negative integer and it is supposed to be 65535 when omitted. You can use an integer greater than 65535 as a rule number.

•   If rule having the same number exists in the kernel, new rule is appended to the last of rule having the same number.

•   Number 0 is an exception of above. The rule having this number is always added at the beginning of rule list.

EXAMPLES
The following example is typical NAT-PT configuration. IPv6 packets which has the prefix 3ffe:ffff:ffff:ffff::/96 are translated into IPv4 packet. Source address of the translated IPv4 packets are set to 172.16.11.22.

    prefix 3ffe:ffff:ffff:ffff::
    map from any6 to 172.16.11.22
    map enable

COMPATIBILITY
Caution is needed because some syntax was changed. This change was done at end of September, 2001. The following is changed point of syntax.

•   ‘interface’ directive was removed.

•   about ‘prefix’ directive, word ‘natpt’ became needless.

•   about ‘map’ directive, word ‘inbound’ and ‘outbound’ became needless. Use ‘dport’ when you want to change destination port number. i.e.,

        map from 202.249.11.251 dport 65305 to 3ffe:0501:041c::1 dport 23

SEE ALSO
natptconfig(8), ifconfig(8)

HISTORY
The natptconfig command first appeared in WIDE/KAME IPv6 protocol stack kit.

BUGS