2009/4/15 Devon H. O'Dell <devon.odell@gmail.com>

I think #2 would be an easily testable and maybe more `correct' way to
do this in Plan 9. I think doing an implementation directly in the IP
path is easier, overall, but that's where my experience lies anyway.

Thanks, I'll try that.

> Do you have any advices on how to capture packets and how to send them out
> again after replacing src/dst addr and port?

It's not quite that simple. At the simplest, when the packet goes out,
you have to keep a tab of the destination host / port and source host
/ port. When a packet comes in, you look up the source host / port in
the hash table (hashed by dest host / port). You rewrite the packet.
You have to regenerate the packet checksum after rewriting it. You
send it back out.

I know it's not that simple. But for the rewriting and keeping state stuff, I can look at the existing implementations of nat, i.e. natd for freebsd.

The thing I need now is the stuff for capturing and sending packets using pkt interfaces.

> Are there any ways of testing NAT in a virtual machine? Right now I'm using
> vmware and it would be nice to be able to test it without setting up a real
> machine with two Ethernet interfaces.

Sure, configure a couple VMs with hostonly networking and set up their
IP addresses accordingly.

Nice, thanks.

> -Patrick Kristiansen

--dho