table of contents
SHOREWALL-NAT(5) | Configuration Files | SHOREWALL-NAT(5) |
NAME¶
nat - Shorewall one-to-one NAT file
SYNOPSIS¶
/etc/shorewall/nat
DESCRIPTION¶
This file is used to define one-to-one Network Address Translation (NAT).
Warning
If all you want to do is simple port forwarding, do NOT use this file. See https://shorewall.org/FAQ.htm#faq1[1]. Also, in many cases, Proxy ARP (shorewall-proxyarp[2](5)) or Proxy-NDP(shorewall6-proxyndp[3](5)) is a better solution that one-to-one NAT.
The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax).
EXTERNAL - {address|?COMMENT}
If you put ?COMMENT in this column, the rest of the line will be attached as a comment to the Netfilter rule(s) generated by the following entries in the file. The comment will appear delimited by "/* ... */" in the output of "shorewall show nat"
To stop the comment from being attached to further rules, simply include ?COMMENT on a line by itself.
INTERFACE - interfacelist[:[digit]]
Each interface must match an entry in shorewall-interfaces[5](5). Shorewall allows loose matches to wildcard entries in shorewall-interfaces[5](5). For example, ppp0 in this file will match a shorewall-interfaces[5](5) entry that defines ppp+.
If you want to override ADD_IP_ALIASES=Yes for a particular entry, follow the interface name with ":" and no digit (e.g., "eth0:").
INTERNAL - address
ALLINTS - [Yes|No]
This column was formerly labelled ALL INTERFACES.
LOCAL - [Yes|No]
RESTRICTIONS¶
DNAT rules always preempt one-to-one NAT rules. This has subtile consequences when there are sub-zones on an interface. Consider the following:
/etc/shorewall/zones:
#ZONE TYPE OPTIONS IN OUT # OPTIONS OPTIONS fw firewall net ipv4 loc ipv4 smc:net ipv4
/etc/shorewall/interfaces:
#ZONE INTERFACE OPTIONS net eth0 dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0 loc eth1 tcpflags,nosmurfs,routefilter,logmartians
/etc/shorewall/hosts:
#ZONE HOST(S) OPTIONS smc eth0:10.1.10.0/24
/etc/shorewall/nat:
#EXTERNAL INTERFACE INTERNAL ALLINTS LOCAL 10.1.10.100 eth0 172.20.1.100
Note that the EXTERNAL address is in the smc zone.
/etc/shorewall/rules:
#ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK CONNLIMIT TIME HEADERS SWITCH HELPER ?SECTION ALL ?SECTION ESTABLISHED ?SECTION RELATED ?SECTION INVALID ?SECTION UNTRACKED ?SECTION NEW ... DNAT net loc:172.20.1.4 tcp 80
For the one-to-one NAT to work correctly in this configuration, one of two approaches can be taken:
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST smc $FW CONTINUE loc net ACCEPT net all DROP info # THE FOLLOWING POLICY MUST BE LAST all all REJECT info
FILES¶
/etc/shorewall/nat
/etc/shorewall6/nat
SEE ALSO¶
https://shorewall.org/NAT.htm[6]
https://shorewall.org/configuration_file_basics.htm#Pairs[7]
NOTES¶
- 2.
- shorewall-proxyarp
- 3.
- shorewall6-proxyndp
- 4.
- shorewall.conf
- 5.
- shorewall-interfaces
09/24/2020 | Configuration Files |