58
Commands for NAT process
1. ip nat
Syntax:
ip nat add|delete <i/f name>
Description:
This command adds or removes NAT functionality from the named interface. The interface name is
the name as listed by the
ip device
command. NAT should always be enabled only on the
interface connecting to the public network, not the interface connecting to the private network.
Example:
>
ip nat add ppp_device
2. nat interfaces
Syntax:
nat interfaces
Description:
The
nat interfaces
command displays the IP router ports on which NAT is currently enabled.
For each of these, a status and IP address is listed. The IP address is discovered automatically from
the IP stack. The status shows the user whether NAT is currently operational on that interface
(“
enabled
”), or whether NAT is still waiting to find out the interface’s IP address (“
not ready
”).
Example:
>
nat interfaces
Name Status IP address
ethernet enabled 194.129.40.2
ppp not ready
3. nat inbound
Syntax:
nat inbound list
nat inbound add <i/f> <port>/<proto> <new IP> [quiet]
nat inbound delete <#>
nat inbound flush
Description:
This command enables the user to list or to set up a series of rules, to determine what happens to
incoming traffic. By default all incoming packets, other that packets arriving in response to
outgoing traffic will be rejected.
The
nat inbound add
command allows packets arriving on a specific port and IP protocol to be
forwarded to a machine on the private network.
<i/f>
is an interface name as shown by the
nat
interface list
command;
<port>
is the destination UDP or TCP port number to match in the
incoming traffic;
<proto>
is the IP protocol, either “udp” or “tcp”;
<new IP>
is the new IP
address on the private network which the packet’s destination IP address should be translated to. If
a rule is added for an interface on which NAT is not enabled, the rule is added anyway but a
warning is printed to alert the user to this fact.
quiet
is a special option which should not
normally be issued at the console, and causes this warning to be suppressed. The
quiet
option is
automatically added by NAT to when writing its configuration to flash; this is because when a
system boots, the NAT process reads in these rules before IP has registered any interfaces
nat inbound list
shows the current rules for inbound traffic, including all the arguments passed
to the
nat inbound add
command.
nat inbound delete
removes a rule, where <#> is the rule number as shown by the
nat
inbound list
command.
nat inbound flush
removes all the rules.
Example:
>
nat inbound add ppp_device 80/TCP 192.168.219.38
>
nat inbound list
# Interface Port/Proto New IP address
1 ppp_device 80/tcp 192.168.219.38
2 r1483 21/tcp 192.168.219.40
>
nat inbound delete 2
