NAT example

NAT example is a fully functional network address translation program written entirely in userspace using YANFF. To run it it is necessary to configure two interfaces, one for private network and another for public. NAT example supports multiple private-public interface pairs, but this instruction describes running NAT with just one pair.

To run NAT on virtual machines configured by YANFF vagrant script you need to create three systems. The following command creates three VMs which are connected with double links, e.g. VM=VM=VM:

VM_GROUP_SIZE=3 VM_TOTAL_NUMBER=3 VM_LINKS_NUMBER=2 vagrant up

To login to these hosts use the same environment values, e.g.

VM_GROUP_SIZE=3 VM_TOTAL_NUMBER=3 VM_LINKS_NUMBER=2 vagrant ssh yanff-2

The middle machine yanff-1 is the NAT host which is connected to two networks and has four network interfaces. YANFF vagrant script uploads configuration scripts to let network configuration easy on all three systems. First system yanff-0 is a system in private NAT network and to configure it you should use command natclient. Second system yanff-1 is NAT host and network configuration on it is done with natsetup. After that it is necessary to execute command bindports on this system to bind two network interfaces to DPDK driver. Third system is server, and configuration is done with natserver.

Setup commands assign static IPs, sets routing and forwarding rules on all three systems which create two chains, first one for YANFF NAT, second one for Linux NAT:

yanff-0: YANFF NAT client 192.168.14.2 which is connected to yanff-1 port 1, where IP address is supposed to be 192.168.14.1
yanff-1: YANFF NAT
yanff-2: YANFF NAT server 192.168.16.2 which is connected to yanff-1 port 0, where IP address is supposed to be 192.168.16.1

and

yanff-0: Linux NAT client 192.168.24.2 which is connected to yanff-1 interface enp0s16
yanff-1: Linux NAT which has iptables rules to forward packets from enp0s16 to enp0s9 and has IP addresses 192.168.24.1 and 192.168.26.2 respectively
yanff-2: Linux NAT server 192.168.26.2 which is connected to yanff-1 interface enp0s9

After network setup is done it should be possible to use Linux NAT chain, e.g. ping yanff-2 from yanff-0:

yanff-0# ping 192.168.26.2

or download web pages from Apache web server on yanff-2:

yanff-0: wget --no-proxy http://192.168.26.2/index.html

or run Apache benchmark against yanff-2 web server:

yanff-0: ab -c 10 -n 10000 http://192.168.26.2/index.html

To run YANFF NAT it is necessary to correct configuration file for the NAT because currently NAT cannot send ARP requests on the server side. On configuration of public-port it is necessary to specify MAC address of interface enp0s8 on yanff-2, e.g.

{
    "port-pairs": [
        {
            "private-port": {
                "index": 1,
                "subnet": "192.168.14.1/24"
            },
            "public-port": {
                "index": 0,
                "dst-mac": "08:00:27:bb:92:1d",
                "subnet": "192.168.16.1"
            }
        }
    ]
}

This configuration file tells NAT to use IP address 192.168.14.1 on port 1, connected with yanff-0 and 192.168.16.1 on port 0 connected with yanff-2. Run YANFF NAT like this:

yanff-1# cd $YANFF/examples/nat/main
yanff-1# sudo ./nat -config config.json

When YANFF NAT is running it should be possible to use ping and download files from web server using 192.168.16.2 address of yanff-2:

yanff-0# ping 192.168.16.2

or download web pages from Apache web server on yanff-2:

yanff-0: wget --no-proxy http://192.168.16.2/index.html

or run Apache benchmark against yanff-2 web server:

yanff-0: ab -c 10 -n 10000 http://192.168.16.2/index.html

When using address 192.168.16.2 the routing rules make packets go through network interface connected to YANFF instead of Linux iptables.