NAT Proxy Filters
B-20
B.3 NAT Proxy Filters
B.3.1 Synopsis
NAT proxy filters are used to allow NAT to operate correctly with network proto-
cols that have addressing specific data in their packet payload data. This API
(and NAT in general) is only used when the TCP/IP stack is acting as an IP
router, and when one the IP network on one side of the router is using virtual
IP addresses.
The functions described in this section illustrates how to install and remove
port proxy filters and their associated callback functions. The functional opera-
tion of NAT and NAT Port Mapping, and NAT Proxy is discussed in more detail
in section B.2.3.
B.3.2 Function Overview
The following functions are used to create and destroy proxy filters:
ProxyNew()
Create Proxy Filter for NAT entries
ProxyFree()
Destroy a Proxy Filter declaration
The following can be called from within a proxy filter callback function:
ProxyPacketMod()
Modify a packet being processed by NAT
B.3.3 NAT Proxy Filter Callback Functions
The proxy filter callback functions allow the proxy programmer to examine NAT
entry properties as the entries are created, plus the examination of packet data
as packets pass between the LAN and WAN. This section describes the syntax
of the callback functions that are supplied to the proxy filter when it is first
installed in the system.
Proxy Enable Callback Function
ProxyEnableCallback
Syntax
int SampleProxyEnableCallback( NATINFO *pNI, uint EnableFlag );
Parameter(s)
pNI
Pointer to NATINFO structure of Nat entry created
EnableFlag
Set to 1 for an enable request
Return Value
1 to allow normal operation, or NULL to abort new NAT entry.
Description
This function is called when a NAT entry containing a proxy is created or de-
stroyed. When the entry is created, the value of EnableFlag is 1. When the
entry is being destroyed, the value of EnableFlag is zero.
When EnableFlag is set, the return value of this function determines if the NAT
entry will be enabled. If this function returns NULL, the NAT entry is immediate-
ly destroyed (in this event, the callback is not called a second time for this de-
stroy). This can be used to restrict peer connections.