mirror of https://github.com/llccd/netfilter-full-cone-nat synced 2024-11-21 23:33:40 +00:00

Go to file

Chion Tang 203af4e1af Remove unused headers		2018-01-21 06:48:24 +00:00
.gitignore	init	2018-01-19 17:53:25 +00:00
libipt_FULLCONENAT.c	init	2018-01-19 17:53:25 +00:00
libipt_FULLCONENAT.t	Add build guide	2018-01-20 12:37:58 +00:00
README.md	Update README.md	2018-01-21 03:20:12 +08:00
xt_FULLCONENAT.c	Remove unused headers	2018-01-21 06:48:24 +00:00

README.md

Implementation of full cone SNAT.

Assuming eth0 is external interface:

iptables -t nat -A POSTROUTING -o eth0 -j FULLCONENAT #same as MASQUERADE  
iptables -t nat -A PREROUTING -i eth0 -j FULLCONENAT  #automatically restore NAT for inbound packets

Currently only UDP traffic is supported for full-cone NAT. For other protos FULLCONENAT is equivalent to MASQUERADE.

Build

Prerequisites:

kernel source
iptables source (git://git.netfilter.org/iptables.git)

Kernel Module

Copy xt_FULLCONENAT.c to kernel-source/net/netfilter/xt_FULLCONENAT.c
Append following line to kernel-source/net/netfilter/Makefile:

obj-$(CONFIG_NETFILTER_XT_TARGET_FULLCONENAT) += xt_FULLCONENAT.o

Insert following section to kernel-source/net/ipv4/netfilter/Kconfig right after config IP_NF_TARGET_NETMAP section:

config IP_NF_TARGET_FULLCONENAT
  tristate "FULLCONENAT target support"
  depends on NETFILTER_ADVANCED
  select NETFILTER_XT_TARGET_FULLCONENAT
  ---help---
  This is a backwards-compat option for the user's convenience
  (e.g. when running oldconfig). It selects
  CONFIG_NETFILTER_XT_TARGET_FULLCONENAT.

Insert following section to kernel-source/net/netfilter/Kconfig right after config NETFILTER_XT_TARGET_NETMAP section:

config NETFILTER_XT_TARGET_FULLCONENAT
  tristate '"FULLCONENAT" target support'
  depends on NF_NAT
  ---help---
  Full Cone NAT

  To compile it as a module, choose M here. If unsure, say N.

cd into the kernel source directory and prepare a working kernel config. This can be done by exporting from your current system:

zcat /proc/config.gz > .config

Run make menuconfig and select: Networking support -> Network options -> Network packet filtering framework (Netfilter) -> IP: Netfilter Configuration -> FULLCONENAT target support
Prepare for building: make prepare
Run make to build the kernel source. Alternatively, run make modules SUBDIRS=net/netfilter to build only the netfilter modules.
Run make modules_install to install all built modules. Alternatively, manually load the xt_FULLCONENAT module by insmod net/netfilter/xt_FULLCONENAT.ko.

IPtables extension

Copy libipt_FULLCONENAT.c and libipt_FULLCONENAT.t to iptables-source/extensions.
Under the iptables source directory, ./configure, make and make install

Usage

Assuming eth0 is external interface:

Basic Usage:

iptables -t nat -A POSTROUTING -o eth0 -j FULLCONENAT
iptables -t nat -A PREROUTING -i eth0 -j FULLCONENAT

Random port range:

iptables -t nat -A POSTROUTING -o eth0 ! -p udp -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -p udp -j FULLCONENAT --to-ports 40000-60000 --random-fully

iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport --dports 40000:60000 -j FULLCONENAT