Easy way to show NAT translation table?

  • Hi all,

    Setting up a outbound NAT rule for only two of the networks behind my firewall (I have many, but these two have private RFC1918 netblocks, and I want to NAT them outbound to a single public IP addr, that is not the outside int's address.) I would like to verify that the NAT is happening correctly; is there a simple way (either thru the GUI or the CLI) to show the current NAT translation table? Something like the Cisco "show ip nat translations" which produces the following sort of output:

    R1# show ip nat translations
    Pro Inside global           Inside local            Outside local         Outside global


  • Anyone? Surely there must be a way….

  • Rebel Alliance Developer Netgate

    Diagnostics > States

  • Try pfctl -s nat.

  • @podilarius:

    Try pfctl -s nat.

    O and you can add v's to get more info. Like

    pfctl -vvs nat

  • Rebel Alliance Developer Netgate

    Those show the nat rules, not the nat translations. The state table would be the only source of seeing the NAT translations.

    At the CLI, to dump the states, use:

    pfctl -ss

    To restrict that to just NAT, try:

    pfctl -ss | egrep '(>.*>|<.*<)'

  • Sorry. Misinterpreted what was being asked for.

Log in to reply