NAT-PMP hole punching with natpmpc and ferm

ferm.conf

def &FORWARD($interface, $port, $dest) = {
  table nat    chain PREROUTING interface $interface proto tcp dport $port mod comment comment "forward $port" DNAT to $dest;
  table filter chain FORWARD    interface $interface proto tcp dport $port daddr $dest ACCEPT;
}
@hook post "pmp-request-forwards 86400";
&FORWARD(eth0, 49152, 192.0.2.1);
&FORWARD(eth0, 49153, 192.0.2.2);

pmp-get-forwards

#!/bin/sh
iptables -n -tnat -L PREROUTING  | sed -rne 's#^.*/\* forward ([^ ]+) \*/.*$#\1#p'

pmp-request-forwards

#!/bin/sh
LIFETIME=$1

if [ -z $LIFETIME ]; then
  echo "Usage: $0 <lifetime>"
  exit
fi

for PORT in $( pmp-get-forwards ); do
  natpmpc -a $PORT $PORT tcp $LIFETIME >/dev/null 2>&1
done