25 March, 1999: I just discovered that current linux kernels 2.2.3/2.2.4/2.2.5 point to this web site if you look at the help for Networking Options->Advanced Routing->Fast NAT.
That is wrong. The code on this site is not part of the official kernel. The NAT that's part of 2.2.x-routing code is from Alexey Kuznetsov, , and the user level tools you need to use it are available on his ftp server in Russia ftp://ftp.inr.ac.ru/, mirrored (connection to Russia is very slow) at ftp://ftp.tux.org/people/alexey-kuznetsov/ip-routing/ and probably elsewhere (Documentation for this stuff: ftp://post.tepkom.ru/pub/vol2/Linux/docs/ (link no longer valid) and http://www.compendium.com.ar/policy-routing.txt). However, if you came here for general information about NAT this is the right website, see below.

25 March, 1999: I just made the probably last version of my NAT code, for 2.2.4. This is a dead-end, development has ended long ago, there's not more functionality in this version than there was in the first (official) one from 2 years ago, which was the first static NAT code for Linux. (My) future (NAT) efforts will go into mainstream code, maybe to Paul Russell's netfilter-code meant for 2.3 development kernels.

Links to existing code:

Port Forwarding (with Linux)
Alternatively, if you just need port forwarding you should download this package: ipmasqadm.tar.gz It is NOT FROM ME, see the accompinying docs. The archive contains the .dif and the spec-file used for creating an rpm-Package for SuSE Linux 6.2 - i.e. that Linux distribution (and later ones as well) will have that package on the CD. After installing the rpm, read /usr/doc/packages/ipmasqad/README.portfw.new for how to use the kernel masquerading module 'portfw' with the user level administration tool ipmasqadm. You need the kernel module, of course, and you'll only get it if you say "yes" to "Prompt for development and/or incomplete drivers". This package can also do some very basic load balancing, and I've seen that working pretty well on a large site (they serve stock quotes), to my surprise (that it worked well), because the algorithms being used are anything but optimal for high performance (hash size too small, completely wrong hash function, but that is because they use the masquerading code backwards and no one can be called stupid for this! Besides, I've been told Alan Cox has fixed the hash function to also work for the load balancing case.). It looks like if you have Windows NT servers even an O(n)-algorithm (searching a linear list for every single packet) is good enough for the load balancer, because the servers are even slower.... No, wrong, NT is not to blame (just couldn't resist to make a senseless joke), but todays Pentium radio-frequency-range PCs are so fast that the algorithm doesn't matter that much. Many people completely overestimate the computing power needed for routing on a 2-10Mbit/s Internet connection. Any Pentium will be bored to death - even while doing masquerading and (basic, e.g. round robin) load balancing.

By the way, have I told you guys that my employer (since March 99, today's 22. July 99) is SuSE? I'm in the 'professional services' group, i.e. projetcs for business partners and customers. So long, and thanks for all the accesses to my stuff, which led me to do this small update today.

And for those who don't know: the major attraction here is (not the forum below, where most question will remain unanswered but) the 50-page document I wrote about NAT in general back in 1997, see a few lines below.

    Name                            Date    Size  Description

 Parent Directory                         -
 README                        28-Jul-97  3k   (very) old document
 nat-static-2.2.4.tar.gz     09-Apr-99  51k  latest, for 2.2.4 (contains an ipnatadm binary
                                                                  and the fix from Jan Panoch)
 nat-static.tar.gz             24-Dec-97  40k  latest, for 2.0
 nat-current.tar.gz            28-Jul-97  36k  old version, virtual server support
 nat-old.tar.gz                27-Jun-97  54k  very old (first public version)
 ipnatadm-glib2.tar.gz         07-Feb-98  20k  ipnatadm binary for 2.0 and glibc2
 NAT paper (HTML)              30-Aug-97  -    ca. 50 (paper) pages
 +   HTML-archive                         113k  for offline reading
 +   Postscript (A4)                      186k
 +   Postscript (letter)                  186k

• nat-static*something*.tar.gz is the latest and a static-NAT-only version.
• nat-current.tar.gz is an older version, but it includes virtual server support (explanation at Check Point) (link no longer exists). This has been removed from the latest version, since it's very experimental (was included just to see if it works at all - it does) and because there was demand for a stable static NAT version, but only one person asked for the virtual server stuff.
• Everything here is for Kernel 2.0.29 and 2.0.33 (2.0.33: static NAT patch only), and the new version is for 2.2.4 (but should work with newer 2.2-kernels as well, maybe you have to apply parts of the patch manually)
  Other kernels (e.g. 2.0.35) will probably work, but you may need to apply parts of the patch manually. This shouldn't be a problem, since the rejects will be small.
• Testers are encouraged to leave a message about their setup and how/if it worked and the like in the HyperNews-Forum below. I also wouldn't mind co-developers. My ideas are outlined in my NAT document.
• You can subscribe so that HyperNews will notify you via email if there's a new message in this forum.
• See http://www.linas.org/linux/load.html for other very useful information

Messages Inline: Outline:

2. First success with Virtual Servers! by Michael Hasenstein, 7/27/97

1. virtual servers web page by Linas Vepstas, 8/03/97

3. New: bug fixes and support for Load Balancing by Michael Hasenstein, 7/28/97

1. Some virtual server hints... by Michael Hasenstein, 7/29/97

4. options in make config ? by Clement, 7/30/97

1. Re: Which options for 'make config' by Michael Hasenstein, 7/30/97

27. Instant Success but serious problems..... by Nils Hammer, 11/18/97

1. Similar problem by Dan Lasley, 11/19/97

29. Can NAT Do this? by Bill Harris, 11/26/97

1. Of course It Can! by Bill Harris, 11/28/97

1. Yes and it could be even more simple by Rolf Cronberg, 11/28/97

1. About the mentioned arp-patch by Michael Hasenstein, 12/03/97

2. Is there a Router involved? by Bill Harris, 12/14/97

1. Do you have all routes installed? by Michael Hasenstein, 12/15/97

2. Do NOT use NAT for internal WEB - redir and ipfwadm are better by Bill Harris, 4/28/98

1. So when should a NAT solution be used with Linux ?? by John Gill, 6/28/98

-> A Similar Question by chunter@unidial.com, 8/06/98

30. Production environment? by Michael J. Maravillo, 11/28/97

1. So far so good by Bill Harris, 11/29/97

2. NAT in a production environment by Dan Lasley, 12/08/97

31. Virtual Routing by Jeff Finucane, 12/02/97

1. me, of course (owner of this forum) by Michael Hasenstein, 12/03/97

-> virsual route by lan, 5/26/98

-> No problem,... by Michael Hasenstein, 5/26/98

32. New version (static NAT only) by Michael Hasenstein, 12/07/97

34. Patch for 2.0.33 by Michael Hasenstein, 12/24/97

1. unable to compile ipnatadm with 2.0.33 patch by Jim Drash, 1/12/98

1. See message 36-1-1-1 by Michael Hasenstein, 1/13/98

-> Is an ipnatadm static binary availble? by jdrash@eesus.jnj.com, 1/14/98

2. Unable to compile ipnatadm.c with nat-patch-2.0.33 by Youngjin Hong, 2/12/98

1. A solution for compilation problem with 2.0.33. by Youngjin Hong, 2/12/98

1. Could there be other solutions as well (still a problem for me!) ??? by Poul Kornmod, 3/10/98

-> Do you have RedHat 5.0? by Michael Hasenstein, 3/10/98

2. Actual solution for ipnatadm with kernel-2.0.33 by Kevin Reynolds, 5/28/98

36. Can NAT do this? by Ennio Porro, 12/28/97

1. Probably but a little more info may be needed by Bill Harris, 12/31/97

1. problem with ipnatadm compiling under 2.0.33 by Roberto Favaro, 12/31/97

1. I don't know... as usual ;-) by Michael Hasenstein, 12/31/97

1. (correction of message text) by Michael Hasenstein, 1/13/98

2. Compiling IP NAT in RedHat 5.1 distribution by Francis Baud, 9/23/98

3. Compiling IP NAT in RedHat 5.1 distribution by Francis Baud, 9/23/98

2. patch by Michael J. Maravillo, 1/13/98

3. here is my solution, hope it works for you too by Jim M. Poon, 2/01/98

4. ipnatadm Binary for glibc-2 by Michael Hasenstein, 2/07/98

1. I can use your binary but still cannot compile! by Joseph Kwok, 5/01/98

-> (answer to ping-problem) by Michael Hasenstein, 5/04/98

2. But what about aliasing? by Ennio Porro, 1/01/98

1. Read Michael Hasenstein's HTML DOC by Bill Harris, 1/04/98

-> My problem by Ennio Porro, 1/06/98

1. Not implemented (yet?) by Michael Hasenstein, 1/09/98

2. NAT and ICA by jim, 1/30/98

38. NAT and masquerading by Doug Kite, 1/07/98

1. Why not by Michael Hasenstein, 1/09/98

43. Help w/Dynamic NAT by t n marinoff, 1/21/98

1. Use port forwarding for outside->inside connections by Michael Hasenstein, 2/03/98

47. Aiee, Killing Interrupt Handler by Bill Harris, 1/29/98

1. Similar Aiee problem by Dan Lasley, 1/29/98

2. version? by Michael J. Maravillo, 1/29/98

1. version info by Dan Lasley, 1/29/98

2. Which Version - 2,0.29 by Bill Harris, 1/29/98

3. How about that 2.0.33-patch? by Michael Hasenstein, 2/03/98

4. It may be another problem by Artur Pinheiro, 3/16/98

48. Using Linux NAT like Checkpoint Firewall-1? by Paul Fremantle, 1/30/98

1. Im doing it by rolfc@hehe.com, 2/02/98

1. It's work only inside.. by SiFu, 2/05/98

1. ports distributing by Roberto Favaro, 2/09/98

-> tcp port redirection by Michael J. Maravillo, 2/09/98

-> ...should be done using something else by Michael Hasenstein, 2/10/98

-> How to use port forwarding... by Keith, 12/22/98

-> ICQ with IPMASQ by SiFu, 12/22/98

1. How to do a NAT with Linux ipchains?? by Hunter Nguyen, 6/03/99

4. How to do a NAT with Linux ipchains?? by Hunter Nguyen, 6/03/99

2. Please tell me where, and which is best. by Homer, 8/25/99

to: "Linux IP NAT Forum"