1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
|
'\" te
.\" To view license terms, attribution, and copyright for IP Filter, the default path is /usr/lib/ipf/IPFILTER.LICENCE. If the Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the installed
.\" location.
.\" Portions Copyright (c) 2008, Sun Microsystems Inc. All Rights Reserved.
.\" Portions Copyright (c) 2013, Joyent, Inc. All Rights Reserved.
.TH IPNAT 1M "Oct 30, 2013"
.SH NAME
ipnat \- user interface to the NAT subsystem
.SH SYNOPSIS
.LP
.nf
\fBipnat\fR [\fB-CdFhlnRrsv\fR] [\fB-G\fR | \fB-z\fR \fIzonename\fR] \fB-f\fR \fIfilename\fR
.fi
.SH DESCRIPTION
.LP
The \fBipnat\fR utility opens a specified file (treating \fB-\fR as stdin) and
parses it for a set of rules that are to be added or removed from the IP NAT.
.sp
.LP
If there are no parsing problems, each rule processed by \fBipnat\fR is added
to the kernel's internal lists. Rules are appended to the internal lists,
matching the order in which they appear when given to \fBipnat\fR.
.sp
.LP
\fBipnat\fR's use is restricted through access to \fB/dev/ipauth\fR,
\fB/dev/ipl\fR, and \fB/dev/ipstate\fR. The default permissions of these files
require \fBipnat\fR to be run as root for all operations.
.sp
.LP
\fBipnat\fR's use is restricted through access to \fB/dev/ipnat\fR. The default
permissions of \fB/dev/ipnat\fR require \fBipnat\fR to be run as root for all
operations.
.SH OPTIONS
.LP
The following options are supported:
.sp
.ne 2
.na
\fB\fB-C\fR\fR
.ad
.RS 15n
Delete all entries in the current NAT rule listing (NAT rules).
.RE
.sp
.ne 2
.na
\fB\fB-d\fR\fR
.ad
.RS 15n
Turn debug mode on. Causes a hex dump of filter rules to be generated as it
processes each one.
.RE
.sp
.ne 2
.na
\fB\fB-F\fR\fR
.ad
.RS 15n
Delete all active entries in the current NAT translation table (currently
active NAT mappings).
.RE
.sp
.ne 2
.na
\fB\fB-f\fR \fIfilename\fR\fR
.ad
.RS 15n
Parse specified file for rules to be added or removed from the IP NAT.
\fIfilename\fR can be stdin.
.RE
.sp
.ne 2
.na
\fB\fB-h\fR\fR
.ad
.RS 15n
Print number of hits for each MAP/Redirect filter.
.RE
.sp
.ne 2
.na
\fB\fB-l\fR\fR
.ad
.RS 15n
Show the list of current NAT table entry mappings.
.RE
.sp
.ne 2
.na
\fB\fB-n\fR\fR
.ad
.RS 15n
Prevents \fBipf\fR from doing anything, such as making ioctl calls, which might
alter the currently running kernel.
.RE
.sp
.ne 2
.na
\fB\fB-R\fR\fR
.ad
.RS 15n
Disable both IP address-to-hostname resolution and port number-to-service name
resolution.
.RE
.sp
.ne 2
.na
\fB\fB-r\fR\fR
.ad
.RS 15n
Remove matching NAT rules rather than add them to the internal lists.
.RE
.sp
.ne 2
.na
\fB\fB-s\fR\fR
.ad
.RS 15n
Retrieve and display NAT statistics.
.RE
.sp
.ne 2
.na
\fB\fB-v\fR\fR
.ad
.RS 15n
Turn verbose mode on. Displays information relating to rule processing and
active rules/table entries.
.RE
.sp
.ne 2
.na
\fB\fB-z\fR \fIzonename\fR\fR
.ad
.RS 15n
Operate on the in-zone IP NAT for the specified zone. If neither this option
nor \fB-G\fR is specified, the current zone is used. This command is only
available in the Global Zone. See \fBZONES\fR in \fBipf\fR(1m) for more
information.
.RE
.sp
.ne 2
.na
\fB\fB-G\fR \fIzonename\fR\fR
.ad
.RS 15n
Operate on the global zone controlled IP NAT for the specified zone. If
neither this option nor \fB-z\fR is specified, the current zone is used. This
command is only available in the Global Zone. See \fBZONES\fR in \fBipf\fR(1m)
for more information.
.RE
.SH FILES
.ne 2
.na
\fB\fB/dev/ipnat\fR\fR
.ad
.sp .6
.RS 4n
Link to IP Filter pseudo device.
.RE
.sp
.ne 2
.na
\fB\fB/dev/kmem\fR\fR
.ad
.sp .6
.RS 4n
Special file that provides access to virtual address space.
.RE
.sp
.ne 2
.na
\fB\fB/etc/ipf/ipnat.conf\fR\fR
.ad
.sp .6
.RS 4n
Location of \fBipnat\fR startup configuration file.
.RE
.sp
.ne 2
.na
\fB\fB/usr/share/ipfilter/examples/\fR\fR
.ad
.sp .6
.RS 4n
Contains numerous IP Filter examples.
.RE
.SH ATTRIBUTES
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp
.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE ATTRIBUTE VALUE
_
Interface Stability Committed
.TE
.SH SEE ALSO
.LP
\fBipf\fR(1M), \fBipfstat\fR(1M), \fBipnat\fR(4), \fBattributes\fR(5),
\fBzones(5)\fR
|
