Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have tried this a few different ways. Currently trying with pf on freebsd 8.2

I am trying to insert a nat solution into an existing network that will redirect traffic from an outside ip address to an inside ip address on all ports (static nat) but I also want to translate the source address.

Current network.




em0 (used to manage the box)
em1 (outside address same lan as outsidehost)
em0_alias0 (inside address same lan as hosta)

I want outsidehost to be able to telnet to by telneting(sp) to

For this to work I assume I will have to change the source of the packet as it leaves em0 or it will get lost on the way back to em1.

So the flow goes like this:

  • from outsidehost telnet
  • change source address to
  • redirect traffic for to
  • the packet leaves with src goes to then gets sent back to translates back to whatever the source addy was in this case

I keep thinking this can be done with

binat and rdr but I can't figure out the syntax.

How can I get this done?

share|improve this question

I ended up going with iptables under linux to accomplish this.

For, IP forwarding needs to be turned on:

echo net.ipv4.ip_forward=1 >> /etc/sysctl.conf

And set the following rules:

iptables -F -t nat
# flush the NAT Table.
iptables -t nat -P INPUT DROP
# set the input chain on the NAT table to DROP by default. 
# This way any traffic not allowed by defining a source address gets dropped.
# If you don't provide a -s address below it will allow all hosts from anywhere
# to reach the inside address via the outside ip. 

iptables -t nat -A PREROUTING -s -d \
         -j DNAT --destination-address 
# define the source and destination of the traffic allowed through.
# Change the dest address to our inside host. 

iptable -t nat -A INPUT -s -J ALLOW
# Drop all traffic on sourcing from inside subnet. 
# This won't apply to traffic that matches the rule above
# as the source address will change in the next rule. 

iptables -t nat -A POSTROUTING -d \
         -j SNAT --source-address
# here is the insert magic. Change the source address of any traffic destined
# for our inside host to our vip or owned inside address.
# This way the traffic is routed back to us at the FW. 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.