Performing Network Address Translation (NAT) - Revision history

Plushkava: Refrain from over-using "note that" as a phrase

2024-02-07T22:51:16Z

Refrain from over-using "note that" as a phrase

← Older revision		Revision as of 22:51, 7 February 2024
Line 138:		Line 138:
	This type of NAT just modifies each packet according to your rules without any other state/connection tracking. This is valid for 1:1 mappings and is faster than stateful NAT. However, it's easy to shoot yourself in the foot. If your environment doesn't require this approach, better stick to stateful NAT.		This type of NAT just modifies each packet according to your rules without any other state/connection tracking. This is valid for 1:1 mappings and is faster than stateful NAT. However, it's easy to shoot yourself in the foot. If your environment doesn't require this approach, better stick to stateful NAT.

	You have to disable connection tracking for modified packets. This can be accomplished by incorporating the '''notrack''' keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the conntrack table. ~~Note that this requires the~~ use of a hook at - or below - a priority level of '''raw'''. Otherwise, '''notrack''' will not be dealt with prior to the consultation of the conntrack table.		You have to disable connection tracking for modified packets. This can be accomplished by incorporating the '''notrack''' keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the conntrack table. The use of a hook at - or below - a priority level of '''raw''' is required. Otherwise, '''notrack''' will not be dealt with prior to the consultation of the conntrack table.

	The ruleset below demonstrates how to rewrite both the destination IP and port for each packet (also covering IPv6). Note that the rules affect ''all'' TCP packets arriving at ''all'' interfaces and are intended only for demonstrative purposes.		The ruleset below demonstrates how to rewrite both the destination IP and port for each packet (also covering IPv6). Note that the rules presented affect ''all'' TCP packets arriving at ''all'' interfaces and are intended only for demonstrative purposes.

	<source>		<source>

Plushkava: Clarify wording regarding stateless rule specificity

2024-02-07T20:41:34Z

Clarify wording regarding stateless rule specificity

← Older revision		Revision as of 20:41, 7 February 2024
Line 140:		Line 140:
	You have to disable connection tracking for modified packets. This can be accomplished by incorporating the '''notrack''' keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the conntrack table. Note that this requires the use of a hook at - or below - a priority level of '''raw'''. Otherwise, '''notrack''' will not be dealt with prior to the consultation of the conntrack table.		You have to disable connection tracking for modified packets. This can be accomplished by incorporating the '''notrack''' keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the conntrack table. Note that this requires the use of a hook at - or below - a priority level of '''raw'''. Otherwise, '''notrack''' will not be dealt with prior to the consultation of the conntrack table.

	The ruleset below demonstrates how to rewrite both the destination IP and port for each packet (also covering IPv6). Note that the rules affect ''all'' packets arriving at ''all'' interfaces and are intended only for demonstrative purposes.		The ruleset below demonstrates how to rewrite both the destination IP and port for each packet (also covering IPv6). Note that the rules affect ''all'' TCP packets arriving at ''all'' interfaces and are intended only for demonstrative purposes.

	<source>		<source>

Plushkava: Indicate that the sample stateless NAT rules are loose in nature

2024-02-07T20:38:10Z

Indicate that the sample stateless NAT rules are loose in nature

← Older revision		Revision as of 20:38, 7 February 2024
Line 140:		Line 140:
	You have to disable connection tracking for modified packets. This can be accomplished by incorporating the '''notrack''' keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the conntrack table. Note that this requires the use of a hook at - or below - a priority level of '''raw'''. Otherwise, '''notrack''' will not be dealt with prior to the consultation of the conntrack table.		You have to disable connection tracking for modified packets. This can be accomplished by incorporating the '''notrack''' keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the conntrack table. Note that this requires the use of a hook at - or below - a priority level of '''raw'''. Otherwise, '''notrack''' will not be dealt with prior to the consultation of the conntrack table.

	The ruleset below demonstrates how to rewrite both the destination IP and port for each packet (also covering IPv6):		The ruleset below demonstrates how to rewrite both the destination IP and port for each packet (also covering IPv6). Note that the rules affect ''all'' packets arriving at ''all'' interfaces and are intended only for demonstrative purposes.

	<source>		<source>

Plushkava: Very minor wording change

2024-02-07T20:34:41Z

Very minor wording change

← Older revision		Revision as of 20:34, 7 February 2024
Line 138:		Line 138:
	This type of NAT just modifies each packet according to your rules without any other state/connection tracking. This is valid for 1:1 mappings and is faster than stateful NAT. However, it's easy to shoot yourself in the foot. If your environment doesn't require this approach, better stick to stateful NAT.		This type of NAT just modifies each packet according to your rules without any other state/connection tracking. This is valid for 1:1 mappings and is faster than stateful NAT. However, it's easy to shoot yourself in the foot. If your environment doesn't require this approach, better stick to stateful NAT.

	You have to disable connection tracking for modified packets. This can be accomplished by incorporating the '''notrack''' keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the ~~connection tracking~~ table. Note that this requires the use of a hook at - or below - a priority level of '''raw'''. Otherwise, '''notrack''' will not be dealt with prior to the consultation of the conntrack table.		You have to disable connection tracking for modified packets. This can be accomplished by incorporating the '''notrack''' keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the conntrack table. Note that this requires the use of a hook at - or below - a priority level of '''raw'''. Otherwise, '''notrack''' will not be dealt with prior to the consultation of the conntrack table.

	The ruleset below demonstrates how to rewrite both the destination IP and port for each packet (also covering IPv6):		The ruleset below demonstrates how to rewrite both the destination IP and port for each packet (also covering IPv6):

Plushkava: Further clarify the use of stateless NAT

2024-02-07T20:32:57Z

Further clarify the use of stateless NAT

← Older revision		Revision as of 20:32, 7 February 2024
Line 136:		Line 136:
	= Stateless NAT =		= Stateless NAT =

	This type of NAT just modifies each packet according to your rules without any other state/connection tracking.		This type of NAT just modifies each packet according to your rules without any other state/connection tracking. This is valid for 1:1 mappings and is faster than stateful NAT. However, it's easy to shoot yourself in the foot. If your environment doesn't require this approach, better stick to stateful NAT.

	~~This is valid~~ for ~~1:1 mappings and is faster than stateful NAT~~. ~~However, it~~'~~s easy~~ to ~~shoot yourself~~ in the ~~foot~~.		You have to disable connection tracking for modified packets. This can be accomplished by incorporating the '''notrack''' keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the connection tracking table. Note that this requires the use of a hook at - or below - a priority level of '''raw'''. Otherwise, '''notrack''' will not be dealt with prior to the consultation of the conntrack table.
	~~If your environment doesn~~'~~t require this approach~~, ~~better stick~~ to ~~stateful NAT~~.

	~~You have~~ to ~~disable connection tracking for modified packets. This can be accomplished by incorporating~~ the ~~"notrack" keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the connection tracking table.~~		The ruleset below demonstrates how to rewrite both the destination IP and port for each packet (also covering IPv6):

	~~The examples below set~~ IP/port for each packet (also ~~for~~ IPv6):

	<source>		<source>
	~~% nft add rule ip~~ raw prerouting ip protocol tcp ip daddr set 192.168.1.100 tcp dport set 10 notrack		table inet raw {
	~~% nft add rule ip6 raw prerouting~~ ip6 nexthdr tcp ip6 daddr set fe00::1 tcp dport set 10 notrack		chain prerouting {
			type filter hook prerouting priority raw; policy accept;
			ip protocol tcp ip daddr set 192.168.1.100 tcp dport set 10 notrack
			ip6 nexthdr tcp ip6 daddr set fe00::1 tcp dport set 10 notrack
			}
			}
	</source>		</source>

Plushkava: Clarify the use of notrack

2024-02-07T20:18:23Z

Clarify the use of notrack

← Older revision		Revision as of 20:18, 7 February 2024
Line 141:		Line 141:
	If your environment doesn't require this approach, better stick to stateful NAT.		If your environment doesn't require this approach, better stick to stateful NAT.

	You have to disable connection tracking for modified packets.		You have to disable connection tracking for modified packets. This can be accomplished by incorporating the "notrack" keyword into the rule. Doing so attaches a template connection tracking entry to the packet that instructs the conntrack core not to initialize a new entry in the connection tracking table.

	The ~~example~~ below ~~sets~~ IP/port for each packet (also ~~valid in~~ IPv6):		The examples below set IP/port for each packet (also for IPv6):

	<source>		<source>

Fmyhr: "{snat|dnat} {ip_addr}" -> "{snat|dnat} TO {ip_addr}"

2021-04-20T01:29:35Z

"{snat|dnat} {ip_addr}" -> "{snat|dnat} TO {ip_addr}"

← Older revision		Revision as of 01:29, 20 April 2021
Line 25:		Line 25:

	<source lang="bash">		<source lang="bash">
	% nft add rule nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat 1.2.3.4		% nft add rule nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat to 1.2.3.4
	</source>		</source>

Line 57:		Line 57:

	<source lang="bash">		<source lang="bash">
	% nft 'add rule nat prerouting iif eth0 tcp dport { 80, 443 } dnat 192.168.1.120'		% nft 'add rule nat prerouting iif eth0 tcp dport { 80, 443 } dnat to 192.168.1.120'
	</source>		</source>

Line 110:		Line 110:
	<source lang="bash">		<source lang="bash">
	% nft add rule nat postrouting masquerade random,persistent		% nft add rule nat postrouting masquerade random,persistent
	% nft add rule nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat 1.2.3.4 fully-random		% nft add rule nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat to 1.2.3.4 fully-random
	</source>		</source>

Fmyhr: /* Stateless NAT */ Updated link to mangling packet headers.

2021-04-16T20:53:00Z

Stateless NAT: Updated link to mangling packet headers.

← Older revision		Revision as of 20:53, 16 April 2021
Line 150:		Line 150:
	</source>		</source>

	Be sure to check our documentation regarding [[~~Mangle packet header fields~~ \| mangling packets]] and [[setting packet connection tracking metainformation]].		Be sure to check our documentation regarding [[Mangling_packet_headers\|mangling packets]] and [[setting packet connection tracking metainformation]].

	To use this feature you require nftables >=0.7 and linux kernel >= 4.9.		To use this feature you require nftables >=0.7 and linux kernel >= 4.9.

Fmyhr: link Wikipedia NAT page

2021-02-15T14:51:44Z

link Wikipedia NAT page

← Older revision		Revision as of 14:51, 15 February 2021
Line 1:		Line 1:
	The ''nat'' chain type allows you to perform NAT. This chain type comes with special semantics:		The ''nat'' chain type allows you to perform [https://en.wikipedia.org/wiki/Network_address_translation NAT]. This chain type comes with special semantics:

	* The first packet of a flow is used to look up for a matching rule which sets up the NAT binding for this flow. This also manipulates this first packet accordingly.		* The first packet of a flow is used to look up for a matching rule which sets up the NAT binding for this flow. This also manipulates this first packet accordingly.

Arturo: /* NAT pooling */ typo

2021-02-04T10:55:49Z

NAT pooling: typo

← Older revision		Revision as of 10:55, 4 February 2021
Line 32:		Line 32:
	=== NAT pooling ===		=== NAT pooling ===

	It is possible to ~~have~~ specify source NAT pooling:		It is possible to specify source NAT pooling:

	<source lang="bash">		<source lang="bash">