ipnat(8) on Solnix vs Linux and the BSDs
On Solnix, ipnat is the illumos ipnat at /usr/sbin/ipnat. It loads NAT rules from a file with -f, like the FreeBSD and NetBSD ipnat. Solnix adds zone options (-G, -z) and -R, and has no -p, -M or -N. Linux and OpenBSD use different tools.
The manual pages
- Solnix: ipnat(8) from
pkgs.solnix.illumos-world-man· illumos.org - Linux: iptables(8) iptables-1.8.13 (different command, similar job)
- Linux: nft(8) nftables-1.1.6 (different command, similar job)
- FreeBSD: ipnat(8) 15.1-RELEASE
- OpenBSD: pfctl(8) 8.0 (different command, similar job)
- NetBSD: ipnat(8) 11.0
- NetBSD: npfctl(8) 11.0 (different command, similar job)
What Solnix runs
A default Solnix system runs the illumos ipnat at /usr/sbin/ipnat. No other variants are shipped. The page's SEE ALSO points to ipnat(5) for the rule syntax, ipf(8) for ZONES and ipfstat(8) for state display.
Differences
| Compared with | Topic | What differs |
|---|---|---|
| FreeBSD, NetBSD | zone options | Solnix ipnat takes -z zonename (in-zone NAT) and -G zonename (global-zone-controlled NAT), both only available in the Global Zone. The FreeBSD and NetBSD synopses have no zone options.Source: Solnix ipnat(8) SYNOPSIS, -z, -G; FreeBSD ipnat(8) SYNOPSIS; NetBSD ipnat(8) SYNOPSIS |
| FreeBSD, NetBSD | -p missing | Solnix ipnat has no -p. On FreeBSD and NetBSD, -p used with -r also removes active NAT sessions created by the rules being removed. The Solnix page does not say what happens to those sessions.Source: FreeBSD ipnat(8) -p; NetBSD ipnat(8) -p; Solnix ipnat(8) OPTIONS |
| FreeBSD, NetBSD | -M and -N missing | FreeBSD and NetBSD ipnat accept -M core and -N system in the synopsis. The Solnix synopsis and OPTIONS list neither.Source: FreeBSD ipnat(8) SYNOPSIS; NetBSD ipnat(8) SYNOPSIS; Solnix ipnat(8) SYNOPSIS |
| FreeBSD, NetBSD | -R name resolution | Solnix ipnat -R disables IP address-to-hostname and port-to-service name resolution. The FreeBSD and NetBSD pages list no -R.Source: Solnix ipnat(8) -R; FreeBSD ipnat(8) OPTIONS; NetBSD ipnat(8) OPTIONS |
| FreeBSD, NetBSD | -f is required in the synopsis | All three ipnat pages show -f filename as part of the synopsis, and all treat - as stdin. On Solnix, -f is the only way to give rules. The -l, -s and -F options are listed in the synopsis of each page too.Source: Solnix ipnat(8) SYNOPSIS, DESCRIPTION; FreeBSD ipnat(8) SYNOPSIS; NetBSD ipnat(8) SYNOPSIS |
| FreeBSD, NetBSD | ipf enabled automatically | FreeBSD and NetBSD enable ipf(8) automatically if it is not enabled when NAT is configured, and packet forwarding must be enabled. The Solnix page does not say this. Source: FreeBSD ipnat(8) DESCRIPTION; NetBSD ipnat(8) DESCRIPTION; Solnix ipnat(8) DESCRIPTION |
| FreeBSD, NetBSD | permissions | The Solnix page says ipnat needs root because of the default permissions on /dev/ipnat (and on /dev/ipauth, /dev/ipl and /dev/ipstate). The FreeBSD and NetBSD pages name no device files. Source: Solnix ipnat(8) DESCRIPTION; FreeBSD ipnat(8) DESCRIPTION; NetBSD ipnat(8) DESCRIPTION |
| Linux | different tools and model | Linux has no ipnat. NAT rules are kept in the nat table of iptables, listed with iptables -t nat -n -L, or in nftables, loaded with nft -f. Solnix reads a separate rules file with ipnat -f.Source: Linux iptables(8) -L; Linux nft(8) -f; Solnix ipnat(8) -f |
| OpenBSD | different tools and model | OpenBSD has no ipnat. NAT is part of the PF ruleset, loaded with pfctl -f file, which replaces the whole ruleset. Solnix ipnat appends rules, in file order, to the NAT rule lists.Source: OpenBSD pfctl(8) DESCRIPTION, -f; Solnix ipnat(8) DESCRIPTION |
| NetBSD | npfctl alternative | NetBSD also has npfctl for NPF. npfctl reload loads /etc/npf.conf unless a path is given, and the reload is atomic. Solnix ipnat appends rules one at a time and has no default file.Source: NetBSD npfctl(8) reload; Solnix ipnat(8) DESCRIPTION, -f |
| Linux, OpenBSD, NetBSD | removing rules and flushing | Solnix ipnat -r removes the rules in the file and -C deletes all NAT rules. iptables -F flushes a chain. pfctl -F rules flushes filter rules and -F states flushes the state table. npfctl has flush.Source: Solnix ipnat(8) -r, -C; Linux iptables(8) -F; OpenBSD pfctl(8) -F; NetBSD npfctl(8) flush |
Everyday tasks
| Task | Solnix | Linux | FreeBSD | OpenBSD | NetBSD |
|---|---|---|---|---|---|
| load NAT rules from a file | ipnat -f filename | nft -f filename | ipnat -f filename | pfctl -f file | ipnat -f filename (or npfctl reload [path]) |
| check rules without applying | ipnat -n -f filename | nft -c -f filename | ipnat -n -f filename | pfctl -n -f file | npfctl validate [path] |
| remove the rules in a file | ipnat -r -f filename | iptables -D chain rule-specification | ipnat -r -f filename | — | ipnat -r -f filename |
| delete all NAT rules | ipnat -C | iptables -t nat -F | ipnat -C | pfctl -F rules | ipnat -C (or npfctl flush) |
| delete active NAT mappings | ipnat -F | — | ipnat -F | pfctl -F states | ipnat -F |
| list current NAT mappings | ipnat -l | iptables -t nat -n -L | ipnat -l | — | ipnat -l (or npfctl show) |
| show NAT statistics | ipnat -s | — | ipnat -s | — | ipnat -s |
Standards
- POSIX: ipnat is not a POSIX.1-2024 utility.
- Solnix: Interface Stability: Committed.
Writing portable scripts
- Branch on the tool that is present (ipnat, nft or iptables, pfctl, npfctl). The rule languages differ: Solnix, FreeBSD and NetBSD ipnat use the ipnat(5) syntax, PF and NPF use their own.
- If a script targets the ipnat family, use only
-C,-F,-d,-h,-l,-n,-r,-s,-vand-f, which all three pages list. Add-ponly for FreeBSD/NetBSD and-z/-G only for Solnix.
Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.