Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

As I notice more often with FreeBSD, there are always plenty of ways that lead to some specific goal.

After figuring out which firewall I wanted (I choose ipfw) I now am completely insecure about which way to do Network Address Translation (NAT).

As I have discovered now, there are two ways to to NAT, I could use the kernel space ipfw nat or I could use the userspace natd.

The only one of these described in the FreeBSD handbook is natd.

What I would like to know is what the main differences are between these? Which one is more popular.

Off course I would also like to be able to fish, so how I can find out these differences in the manuals/handbooks?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

ipfw nat is generally preferable, since it runs in kernel-space and consumes less CPU than divert+natd. But natd still can be useful if you need to dynamically add rules for FTP connections (look for -punch_fw option in natd(8)). Handbook page is badly outdated.

share|improve this answer

First of all, you're not alone (mailing list thread on the issue).

From it, I gathered that natd apparently was the only choice up to FreeBSD 7.x and that the handbook page you referenced probably needs revision (see this post), and in-kernel NAT is possibly faster.

Apart from that, both solutions still seem fine (both are present in a standard FreeBSD installation, after all) and the usual kernelspace/userspace arguments apply...not the most satisfactory answer, sorry.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.