|
 |
049c96 |
From 4670c581d7173b300d30eedfc6a4ddbf504011bd Mon Sep 17 00:00:00 2001
|
|
|
049c96 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
049c96 |
Date: Wed, 30 Mar 2016 16:43:19 +0200
|
|
|
049c96 |
Subject: [PATCH] man: Add a man page for the nat action
|
|
|
049c96 |
|
|
|
049c96 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1275426
|
|
|
049c96 |
Upstream Status: iproute2.git commit ec0bab1e028a9
|
|
|
049c96 |
|
|
|
049c96 |
commit ec0bab1e028a9a8178ae18c4fa6ca600dcf167ba
|
|
|
049c96 |
Author: Phil Sutter <phil@nwl.cc>
|
|
|
049c96 |
Date: Fri Mar 4 13:11:39 2016 +0100
|
|
|
049c96 |
|
|
|
049c96 |
man: Add a man page for the nat action
|
|
|
049c96 |
|
|
|
049c96 |
Cc: Herbert Xu <herbert@gondor.apana.org.au>
|
|
|
049c96 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
049c96 |
---
|
|
|
049c96 |
man/man8/tc-nat.8 | 78 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
049c96 |
1 file changed, 78 insertions(+)
|
|
|
049c96 |
create mode 100644 man/man8/tc-nat.8
|
|
|
049c96 |
|
|
|
049c96 |
diff --git a/man/man8/tc-nat.8 b/man/man8/tc-nat.8
|
|
|
049c96 |
new file mode 100644
|
|
|
049c96 |
index 0000000..fdcc052
|
|
|
049c96 |
--- /dev/null
|
|
|
049c96 |
+++ b/man/man8/tc-nat.8
|
|
|
049c96 |
@@ -0,0 +1,78 @@
|
|
|
049c96 |
+.TH "NAT action in tc" 8 "12 Jan 2015" "iproute2" "Linux"
|
|
|
049c96 |
+
|
|
|
049c96 |
+.SH NAME
|
|
|
049c96 |
+nat - stateless native address translation action
|
|
|
049c96 |
+.SH SYNOPSIS
|
|
|
049c96 |
+.in +8
|
|
|
049c96 |
+.ti -8
|
|
|
049c96 |
+.BR tc " ... " "action nat"
|
|
|
049c96 |
+.I DIRECTION OLD NEW
|
|
|
049c96 |
+
|
|
|
049c96 |
+.ti -8
|
|
|
049c96 |
+.IR DIRECTION " := { "
|
|
|
049c96 |
+.BR ingress " | " egress " }"
|
|
|
049c96 |
+
|
|
|
049c96 |
+.ti -8
|
|
|
049c96 |
+.IR OLD " := " IPV4_ADDR_SPEC
|
|
|
049c96 |
+
|
|
|
049c96 |
+.ti -8
|
|
|
049c96 |
+.IR NEW " := " IPV4_ADDR_SPEC
|
|
|
049c96 |
+
|
|
|
049c96 |
+.ti -8
|
|
|
049c96 |
+.IR IPV4_ADDR_SPEC " := { "
|
|
|
049c96 |
+.BR default " | " any " | " all " | "
|
|
|
049c96 |
+\fIin_addr\fR[\fB/\fR{\fIprefix\fR|\fInetmask\fR}]
|
|
|
049c96 |
+.SH DESCRIPTION
|
|
|
049c96 |
+The
|
|
|
049c96 |
+.B nat
|
|
|
049c96 |
+action allows to perform NAT without the overhead of conntrack, which is
|
|
|
049c96 |
+desirable if the number of flows or addresses to perform NAT on is large. This
|
|
|
049c96 |
+action is best used in combination with the
|
|
|
049c96 |
+.B u32
|
|
|
049c96 |
+filter to allow for efficient lookups of a large number of stateless NAT rules
|
|
|
049c96 |
+in constant time.
|
|
|
049c96 |
+.SH OPTIONS
|
|
|
049c96 |
+.TP
|
|
|
049c96 |
+.B ingress
|
|
|
049c96 |
+Translate destination addresses, i.e. perform DNAT.
|
|
|
049c96 |
+.TP
|
|
|
049c96 |
+.B egress
|
|
|
049c96 |
+Translate source addresses, i.e. perform SNAT.
|
|
|
049c96 |
+.TP
|
|
|
049c96 |
+.I OLD
|
|
|
049c96 |
+Specifies addresses which should be translated.
|
|
|
049c96 |
+.TP
|
|
|
049c96 |
+.I NEW
|
|
|
049c96 |
+Specifies addresses which
|
|
|
049c96 |
+.I OLD
|
|
|
049c96 |
+should be translated into.
|
|
|
049c96 |
+.SH NOTES
|
|
|
049c96 |
+The accepted address format in
|
|
|
049c96 |
+.IR OLD " and " NEW
|
|
|
049c96 |
+is quite flexible. It may either consist of one of the keywords
|
|
|
049c96 |
+.BR default ", " any " or " all ,
|
|
|
049c96 |
+representing the all-zero IP address or a combination of IP address and netmask
|
|
|
049c96 |
+or prefix length separated by a slash
|
|
|
049c96 |
+.RB ( / )
|
|
|
049c96 |
+sign. In any case, the mask (or prefix length) value of
|
|
|
049c96 |
+.I OLD
|
|
|
049c96 |
+is used for
|
|
|
049c96 |
+.I NEW
|
|
|
049c96 |
+as well so that a one-to-one mapping of addresses is assured.
|
|
|
049c96 |
+
|
|
|
049c96 |
+Address translation is done using a combination of binary operations. First, the
|
|
|
049c96 |
+original (source or destination) address is matched against the value of
|
|
|
049c96 |
+.IR OLD .
|
|
|
049c96 |
+If the original address fits, the new address is created by taking the leading
|
|
|
049c96 |
+bits from
|
|
|
049c96 |
+.I NEW
|
|
|
049c96 |
+(defined by the netmask of
|
|
|
049c96 |
+.IR OLD )
|
|
|
049c96 |
+and taking the remaining bits from the original address.
|
|
|
049c96 |
+
|
|
|
049c96 |
+There is rudimental support for upper layer protocols, namely TCP, UDP and ICMP.
|
|
|
049c96 |
+While for the first two only checksum recalculation is performed, the action
|
|
|
049c96 |
+also takes care of embedded IP headers in ICMP packets by translating the
|
|
|
049c96 |
+respective address therein, too.
|
|
|
049c96 |
+.SH SEE ALSO
|
|
|
049c96 |
+.BR tc (8)
|
|
|
049c96 |
--
|
|
|
049c96 |
1.8.3.1
|
|
|
049c96 |
|