man-pages/man8/tc-nat.8.html
2021-03-31 01:06:50 +01:00

148 lines
3.2 KiB
HTML

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML><HEAD><TITLE>Man page of NAT action in tc</TITLE>
</HEAD><BODY>
<H1>NAT action in tc</H1>
Section: Linux (8)<BR>Updated: 12 Jan 2015<BR><A HREF="#index">Index</A>
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
<P>
<A NAME="lbAB">&nbsp;</A>
<H2>NAME</H2>
nat - stateless native address translation action
<A NAME="lbAC">&nbsp;</A>
<H2>SYNOPSIS</H2>
<BR>
<B>tc</B> ... <B>action nat</B>
<I>DIRECTION OLD NEW</I>
<P>
<BR>
<I>DIRECTION</I> := {
<B>ingress</B> | <B>egress</B> }
<P>
<BR>
<I>OLD</I> := <I>IPV4_ADDR_SPEC</I>
<P>
<BR>
<I>NEW</I> := <I>IPV4_ADDR_SPEC</I>
<P>
<BR>
<I>IPV4_ADDR_SPEC</I> := {
<B>default</B> | <B>any</B> | <B>all</B> |
<I>in_addr</I>[<B>/</B>{<I>prefix</I>|<I>netmask</I>}]
<A NAME="lbAD">&nbsp;</A>
<H2>DESCRIPTION</H2>
The
<B>nat</B>
action allows to perform NAT without the overhead of conntrack, which is
desirable if the number of flows or addresses to perform NAT on is large. This
action is best used in combination with the
<B>u32</B>
filter to allow for efficient lookups of a large number of stateless NAT rules
in constant time.
<A NAME="lbAE">&nbsp;</A>
<H2>OPTIONS</H2>
<DL COMPACT>
<DT id="1"><B>ingress</B>
<DD>
Translate destination addresses, i.e. perform DNAT.
<DT id="2"><B>egress</B>
<DD>
Translate source addresses, i.e. perform SNAT.
<DT id="3"><I>OLD</I>
<DD>
Specifies addresses which should be translated.
<DT id="4"><I>NEW</I>
<DD>
Specifies addresses which
<I>OLD</I>
should be translated into.
</DL>
<A NAME="lbAF">&nbsp;</A>
<H2>NOTES</H2>
The accepted address format in
<I>OLD</I> and <I>NEW</I>
is quite flexible. It may either consist of one of the keywords
<B>default</B>, <B>any</B> or <B>all</B>,
representing the all-zero IP address or a combination of IP address and netmask
or prefix length separated by a slash
(<B>/</B>)
sign. In any case, the mask (or prefix length) value of
<I>OLD</I>
is used for
<I>NEW</I>
as well so that a one-to-one mapping of addresses is assured.
<P>
Address translation is done using a combination of binary operations. First, the
original (source or destination) address is matched against the value of
<I>OLD</I>.
If the original address fits, the new address is created by taking the leading
bits from
<I>NEW</I>
(defined by the netmask of
<I>OLD</I>)
and taking the remaining bits from the original address.
<P>
There is rudimental support for upper layer protocols, namely TCP, UDP and ICMP.
While for the first two only checksum recalculation is performed, the action
also takes care of embedded IP headers in ICMP packets by translating the
respective address therein, too.
<A NAME="lbAG">&nbsp;</A>
<H2>SEE ALSO</H2>
<B><A HREF="/cgi-bin/man/man2html?8+tc">tc</A></B>(8)
<P>
<HR>
<A NAME="index">&nbsp;</A><H2>Index</H2>
<DL>
<DT id="5"><A HREF="#lbAB">NAME</A><DD>
<DT id="6"><A HREF="#lbAC">SYNOPSIS</A><DD>
<DT id="7"><A HREF="#lbAD">DESCRIPTION</A><DD>
<DT id="8"><A HREF="#lbAE">OPTIONS</A><DD>
<DT id="9"><A HREF="#lbAF">NOTES</A><DD>
<DT id="10"><A HREF="#lbAG">SEE ALSO</A><DD>
</DL>
<HR>
This document was created by
<A HREF="/cgi-bin/man/man2html">man2html</A>,
using the manual pages.<BR>
Time: 00:06:17 GMT, March 31, 2021
</BODY>
</HTML>