mirrors/netfilter-full-cone-nat
1
0
Fork 0
mirror of https://github.com/llccd/netfilter-full-cone-nat synced 2024-11-21 23:33:40 +00:00
Code Issues Packages Projects Releases Wiki Activity
65 Commits 5 Branches 0 Tags 131 KiB
C 97.9%
Makefile 1.1%
Shell 0.5%
Raku 0.5%
ac63552a67
Go to file
Chion Tang ac63552a67
Update README.md
2018-06-06 10:29:20 +08:00
.gitignore feature: support for multiple external interfaces 2018-03-13 16:33:32 +00:00
libipt_FULLCONENAT.c Check macro NF_NAT_RANGE_PROTO_RANDOM_FULLY 2018-05-20 22:55:23 +08:00
libipt_FULLCONENAT.t Add build guide 2018-01-20 12:37:58 +00:00
Makefile feature: support for multiple external interfaces 2018-03-13 16:33:32 +00:00
README.md Update README.md 2018-06-06 10:29:20 +08:00
xt_FULLCONENAT.c Check macro NF_NAT_RANGE_PROTO_RANDOM_FULLY 2018-05-21 01:55:54 +08:00

README.md

Implementation of RFC3489-compatible full cone SNAT.

Assuming eth0 is external interface:

iptables -t nat -A POSTROUTING -o eth0 -j FULLCONENAT #same as MASQUERADE  
iptables -t nat -A PREROUTING -i eth0 -j FULLCONENAT  #automatically restore NAT for inbound packets

Currently only UDP traffic is supported for full-cone NAT. For other protos FULLCONENAT is equivalent to MASQUERADE.

Build

Prerequisites:

  • kernel source
  • iptables source ( git://git.netfilter.org/iptables.git )

Confirm the kernel configuration option CONFIG_NF_CONNTRACK_EVENTS is enabled. If this option is disabled on your system, enable it and rebuild your netfilter modules.

Kernel Module

$ make
# insmod xt_FULLCONENAT.ko

Iptables Extension

  1. Copy libipt_FULLCONENAT.c to iptables-source/extensions.

  2. Under the iptables source directory, ./configure(use --prefix to replace your current iptables by looking at which iptables), make and make install

OpenWRT

Package for openwrt is available at https://github.com/LGA1150/openwrt-fullconenat

Usage

Assuming eth0 is external interface:

Basic Usage:

iptables -t nat -A POSTROUTING -o eth0 -j FULLCONENAT
iptables -t nat -A PREROUTING -i eth0 -j FULLCONENAT

Random port range:

iptables -t nat -A POSTROUTING -o eth0 ! -p udp -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -p udp -j FULLCONENAT --to-ports 40000-60000 --random-fully

iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport --dports 40000:60000 -j FULLCONENAT

Hairpin NAT (Assuming eth1 is LAN interface and IP range for LAN is 192.168.100.0/24):

iptables -t nat -A POSTROUTING -o eth0 -j FULLCONENAT
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.100.0/24 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -j FULLCONENAT
iptables -t nat -A PREROUTING -i eth1 -j FULLCONENAT

kernel Patch (Optional.)

  1. Copy xt_FULLCONENAT.c to kernel-source/net/netfilter/xt_FULLCONENAT.c
  2. Append following line to kernel-source/net/netfilter/Makefile:
obj-$(CONFIG_NETFILTER_XT_TARGET_FULLCONENAT) += xt_FULLCONENAT.o
  1. Insert following section into kernel-source/net/ipv4/netfilter/Kconfig right after config IP_NF_TARGET_NETMAP section:
config IP_NF_TARGET_FULLCONENAT
  tristate "FULLCONENAT target support"
  depends on NETFILTER_ADVANCED
  select NETFILTER_XT_TARGET_FULLCONENAT
  ---help---
  This is a backwards-compat option for the user's convenience
  (e.g. when running oldconfig). It selects
  CONFIG_NETFILTER_XT_TARGET_FULLCONENAT.
  1. Insert following section into kernel-source/net/netfilter/Kconfig right after config NETFILTER_XT_TARGET_NETMAP section:
config NETFILTER_XT_TARGET_FULLCONENAT
  tristate '"FULLCONENAT" target support'
  depends on NF_NAT
  ---help---
  Full Cone NAT

  To compile it as a module, choose M here. If unsure, say N.
  1. Run make menuconfig and select: Networking support -> Network options -> Network packet filtering framework (Netfilter) -> IP: Netfilter Configuration -> <M> FULLCONENAT target support