As I notice more often with FreeBSD, there are always plenty of ways that lead to some specific goal.

After figuring out which firewall I wanted (I choose ipfw) I now am completely insecure about which way to do Network Address Translation (NAT).

As I have discovered now, there are two ways to to NAT, I could use the kernel space ipfw nat or I could use the userspace natd.

The only one of these described in the FreeBSD handbook is natd.

What I would like to know is what the main differences are between these? Which one is more popular.

Off course I would also like to be able to fish, so how I can find out these differences in the manuals/handbooks?


ipfw nat is generally preferable, since it runs in kernel-space and consumes less CPU than divert+natd. But natd still can be useful if you need to dynamically add rules for FTP connections (look for -punch_fw option in natd(8)). Handbook page is badly outdated.


First of all, you're not alone (mailing list thread on the issue).

From it, I gathered that natd apparently was the only choice up to FreeBSD 7.x and that the handbook page you referenced probably needs revision (see this post), and in-kernel NAT is possibly faster.

Apart from that, both solutions still seem fine (both are present in a standard FreeBSD installation, after all) and the usual kernelspace/userspace arguments apply...not the most satisfactory answer, sorry.


I didn't even know there was a kernel nat (natd replacement) until tonight. My natd is using stupid amounts of cpu cycles, even when there is hardly any traffic. It seems that you need to carefully control what type of packets go through natd to avoid this high cpu. And it depends of the nature of your environment as to what ipfw rules are best to avoid unwanted traffic being diverted to natd.

I can't find a simple ruleset that doesn't cause problems for me. I suspect it's because I have jails running on LAN IPs, and that generates traffic through natd. So, i'm now off to learn ipfw + kernel nat.

The handbook really just needs to mention this, even a one-liner would be enough to start with.

  • This should be a comment, not an answer, unless you are actually attempting to answer the posted question. – jayhendren Jan 29 '15 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.