FreeBSD's Network Address Translation (NAT) daemon, natd(8), accepts incoming raw IP packets, changes the source to the local machine, and injects these packets back into the outgoing IP packet stream. The source IP address and port are changed such that when data is received back, it is able to determine the original location of the data and forward it back to its original requester.

The most common use of NAT is to perform what is commonly known as Internet Connection Sharing.

Due to the diminishing IP address space in IPv4 and the increased number of users on high-speed consumer lines such as cable or DSL, people are increasingly in need of an Internet Connection Sharing solution. The ability to connect several computers online through one connection and IP address makes natd(8) a reasonable choice.

Most commonly, a user has a machine connected to a cable or DSL line with one IP address and wishes to use this one connected computer to provide Internet access to several more over a LAN.

To do this, the FreeBSD machine connected to the Internet must act as a gateway. This gateway machine must have two NICs: one connects to the Internet router and the other connects to a LAN. All the machines on the LAN are connected through a hub or switch.

A setup like this is commonly used to share an Internet connection. One of the LAN machines is connected to the Internet and the rest of the machines access the Internet through that “gateway” machine.

The kernel features for natd(8) are not enabled in the GENERIC kernel, but they can be loaded at boot time by adding a couple of options to /boot/loader.conf:

ipfw_load="YES"
ipdivert_load="YES"

Additionally, the net.inet.ip.fw.default_to_accept tunable option should be set to 1:

net.inet.ip.fw.default_to_accept="1"

When modules are not an option or if it is preferable to build all the required features into a custom kernel, the following options must be in the custom kernel configuration file:

options IPFIREWALL
options IPDIVERT

Additionally, the following may also be suitable:

options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPFIREWALL_VERBOSE

To enable firewall and NAT support at boot time, the following must be in /etc/rc.conf:

gateway_enable="YES" 
firewall_enable="YES" 
firewall_type="OPEN" 
natd_enable="YES"
natd_interface="fxp0" 
natd_flags="" 

These /etc/rc.conf options will run natd -interface fxp0 at boot. This can also be run manually after boot.

natd_flags="-f /etc/natd.conf"

redirect_port tcp 192.168.0.2:6667 6667
redirect_port tcp 192.168.0.3:80 80

Each machine and interface behind the LAN should be assigned IP addresses in the private network space, as defined by RFC 1918, and have a default gateway of the natd(8) machine's internal IP address.

For example, client A and B behind the LAN have IP addresses of 192.168.0.2 and 192.168.0.3, while the natd(8) machine's LAN interface has an IP address of 192.168.0.1. The default gateway of clients A and B must be set to that of the natd(8) machine, 192.168.0.1. The natd(8) machine's external Internet interface does not require any special modification for natd(8) to work.

The drawback with natd(8) is that the LAN clients are not accessible from the Internet. Clients on the LAN can make outgoing connections to the world but cannot receive incoming ones. This presents a problem if trying to run Internet services on one of the LAN client machines. A simple way around this is to redirect selected Internet ports on the natd(8) machine to a LAN client.

For example, an IRC server runs on client A and a web server runs on client B. For this to work properly, connections received on ports 6667 (IRC) and 80 (HTTP) must be redirected to the respective machines.

The syntax for -redirect_port is as follows:

     -redirect_port proto targetIP:targetPORT[-targetPORT]
                 [aliasIP:]aliasPORT[-aliasPORT]
                 [remoteIP[:remotePORT[-remotePORT]]]

In the above example, the argument should be:

    -redirect_port tcp 192.168.0.2:6667 6667
    -redirect_port tcp 192.168.0.3:80 80

This redirects the proper TCP ports to the LAN client machines.

Port ranges over individual ports can be indicated with -redirect_port. For example, tcp 192.168.0.2:2000-3000 2000-3000 would redirect all connections received on ports 2000 to 3000 to ports 2000 to 3000 on client A.

These options can be used when directly running natd(8), placed within the natd_flags="" option in /etc/rc.conf, or passed via a configuration file.

For further configuration options, consult natd(8)

Address redirection is useful if more than one IP address is available. Each LAN client can be assigned its own external IP address by natd(8), which will then rewrite outgoing packets from the LAN clients with the proper external IP address and redirects all traffic incoming on that particular IP address back to the specific LAN client. This is also known as static NAT. For example, if IP addresses 128.1.1.1, 128.1.1.2, and 128.1.1.3 are available, 128.1.1.1 can be used as the natd(8) machine's external IP address, while 128.1.1.2 and 128.1.1.3 are forwarded back to LAN clients A and B.

The -redirect_address syntax is as follows:

-redirect_address localIP publicIP

In the example, this argument would read:

-redirect_address 192.168.0.2 128.1.1.2
-redirect_address 192.168.0.3 128.1.1.3

Like -redirect_port, these arguments are placed within the natd_flags="" option of /etc/rc.conf, or passed via a configuration file. With address redirection, there is no need for port redirection since all data received on a particular IP address is redirected.

The external IP addresses on the natd(8) machine must be active and aliased to the external interface. Refer to rc.conf(5) for details.