148 lines
3.2 KiB
HTML
148 lines
3.2 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of NAT action in tc</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>NAT action in tc</H1>
|
|
Section: Linux (8)<BR>Updated: 12 Jan 2015<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<P>
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
nat - stateless native address translation action
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
|
|
<BR>
|
|
|
|
<B>tc</B> ... <B>action nat</B>
|
|
|
|
<I>DIRECTION OLD NEW</I>
|
|
|
|
<P>
|
|
<BR>
|
|
|
|
<I>DIRECTION</I> := {
|
|
|
|
<B>ingress</B> | <B>egress</B> }
|
|
|
|
<P>
|
|
<BR>
|
|
|
|
<I>OLD</I> := <I>IPV4_ADDR_SPEC</I>
|
|
|
|
<P>
|
|
<BR>
|
|
|
|
<I>NEW</I> := <I>IPV4_ADDR_SPEC</I>
|
|
|
|
<P>
|
|
<BR>
|
|
|
|
<I>IPV4_ADDR_SPEC</I> := {
|
|
|
|
<B>default</B> | <B>any</B> | <B>all</B> |
|
|
|
|
<I>in_addr</I>[<B>/</B>{<I>prefix</I>|<I>netmask</I>}]
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
The
|
|
<B>nat</B>
|
|
|
|
action allows to perform NAT without the overhead of conntrack, which is
|
|
desirable if the number of flows or addresses to perform NAT on is large. This
|
|
action is best used in combination with the
|
|
<B>u32</B>
|
|
|
|
filter to allow for efficient lookups of a large number of stateless NAT rules
|
|
in constant time.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>ingress</B>
|
|
|
|
<DD>
|
|
Translate destination addresses, i.e. perform DNAT.
|
|
<DT id="2"><B>egress</B>
|
|
|
|
<DD>
|
|
Translate source addresses, i.e. perform SNAT.
|
|
<DT id="3"><I>OLD</I>
|
|
|
|
<DD>
|
|
Specifies addresses which should be translated.
|
|
<DT id="4"><I>NEW</I>
|
|
|
|
<DD>
|
|
Specifies addresses which
|
|
<I>OLD</I>
|
|
|
|
should be translated into.
|
|
</DL>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
The accepted address format in
|
|
<I>OLD</I> and <I>NEW</I>
|
|
|
|
is quite flexible. It may either consist of one of the keywords
|
|
<B>default</B>, <B>any</B> or <B>all</B>,
|
|
|
|
representing the all-zero IP address or a combination of IP address and netmask
|
|
or prefix length separated by a slash
|
|
(<B>/</B>)
|
|
|
|
sign. In any case, the mask (or prefix length) value of
|
|
<I>OLD</I>
|
|
|
|
is used for
|
|
<I>NEW</I>
|
|
|
|
as well so that a one-to-one mapping of addresses is assured.
|
|
<P>
|
|
Address translation is done using a combination of binary operations. First, the
|
|
original (source or destination) address is matched against the value of
|
|
<I>OLD</I>.
|
|
|
|
If the original address fits, the new address is created by taking the leading
|
|
bits from
|
|
<I>NEW</I>
|
|
|
|
(defined by the netmask of
|
|
<I>OLD</I>)
|
|
|
|
and taking the remaining bits from the original address.
|
|
<P>
|
|
There is rudimental support for upper layer protocols, namely TCP, UDP and ICMP.
|
|
While for the first two only checksum recalculation is performed, the action
|
|
also takes care of embedded IP headers in ICMP packets by translating the
|
|
respective address therein, too.
|
|
<A NAME="lbAG"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+tc">tc</A></B>(8)
|
|
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="5"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="6"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="7"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="8"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DT id="9"><A HREF="#lbAF">NOTES</A><DD>
|
|
<DT id="10"><A HREF="#lbAG">SEE ALSO</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:17 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|