FreeBSD kernel nat or natd?

Question

As I notice more often with FreeBSD, there are always plenty of ways that lead to some specific goal.

After figuring out which firewall I wanted (I choose ipfw) I now am completely insecure about which way to do Network Address Translation (NAT).

As I have discovered now, there are two ways to to NAT, I could use the kernel space ipfw nat or I could use the userspace natd.

The only one of these described in the FreeBSD handbook is natd.

What I would like to know is what the main differences are between these? Which one is more popular.

Off course I would also like to be able to fish, so how I can find out these differences in the manuals/handbooks?

Answer 1

ipfw nat is generally preferable, since it runs in kernel-space and consumes less CPU than divert+natd. But natd still can be useful if you need to dynamically add rules for FTP connections (look for -punch_fw option in natd(8)). Handbook page is badly outdated.

Answer 2

First of all, you're not alone (mailing list thread on the issue).

From it, I gathered that natd apparently was the only choice up to FreeBSD 7.x and that the handbook page you referenced probably needs revision (see this post), and in-kernel NAT is possibly faster.

Apart from that, both solutions still seem fine (both are present in a standard FreeBSD installation, after all) and the usual kernelspace/userspace arguments apply...not the most satisfactory answer, sorry.