Difference between revisions of "Performing Network Address Translation (NAT)"

From nftables wiki
Jump to navigation Jump to search
(no NAT in inet family warning)
(fixed prerouting priority ** added inet nat support note ** corrected warning about prerouting/postrouting base-chain need in older kernels)
Line 3: Line 3:
* The first packet of a flow is used to look up for a matching rule which sets up the NAT binding for this flow. This also manipulates this first packet accordingly.
* The first packet of a flow is used to look up for a matching rule which sets up the NAT binding for this flow. This also manipulates this first packet accordingly.
* No rule lookup happens for follow up packets in the flow: the NAT engine uses the NAT binding information already set up by the first packet to perform the packet manipulation.
* No rule lookup happens for follow up packets in the flow: the NAT engine uses the NAT binding information already set up by the first packet to perform the packet manipulation.
* '''You are required to register both chains (original/reply directions, prerouting/postrouting) in order for the NAT engine to work.'''


Adding a NAT rule to a filter type chain will result in an error. Also please note that there is no support for doing NAT in the '''inet''' family (you need 2 chains, one for IPv4 and other for IPv6), but this may change in the future.
Adding a NAT rule to a filter type chain will result in an error.


= Stateful NAT =
= Stateful NAT =
Line 12: Line 11:
This is the most common way of performing NAT and the approach we recommend you to follow.
This is the most common way of performing NAT and the approach we recommend you to follow.


Be aware that '''you have to register the prerouting/postrouting chains even if you have no rules there''' since these chain will invoke the NAT engine for the packets coming in the reply direction.
Be aware that '''with kernel versions before 4.18, you have to register the prerouting/postrouting chains even if you have no rules there''' since these chain will invoke the NAT engine for the packets coming in the reply direction. The remaining documentation in this article assumes a newer kernel which doesn't require this inconvenience anymore.


== Source NAT ==
== Source NAT ==


If you want to source NAT the traffic that leaves from your local area network to the Internet, you can create a new table ''nat'' with the prerouting and postrouting chains:
If you want to source NAT the traffic that leaves from your local area network to the Internet, you can create a new table ''nat'' with the postrouting chain:


<source lang="bash">
<source lang="bash">
% nft add table nat
% nft add table nat
% nft add chain nat prerouting { type nat hook prerouting priority 0 \; }
% nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
% nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
</source>
</source>
Line 38: Line 36:
<source lang="bash">
<source lang="bash">
% nft add table nat
% nft add table nat
% nft add chain nat prerouting { type nat hook prerouting priority 0 \; }
% nft add chain nat prerouting { type nat hook prerouting priority \-100 \; }
% nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
</source>
</source>


Line 48: Line 45:
</source>
</source>


This redirects the incoming traffic for TCP ports 80 and 443 to 192.168.1.120. Don't forget to register the postrouting chain since this invokes the NAT engine for follow up packets going in the reply direction.
This redirects the incoming traffic for TCP ports 80 and 443 to 192.168.1.120.


== Masquerading ==
== Masquerading ==
Line 60: Line 57:
</source>
</source>


Note that:
Note that ''masquerade'' only makes sense from postrouting chain of NAT type.
 
# ''masquerade'' only makes sense from postrouting chain of NAT type.
# you still have to add the prerouting nat chain, since this translate traffic in the reply direction.
 


== Redirect ==
== Redirect ==
Line 82: Line 75:
</source>
</source>


Note that:
Note that: ''redirect'' only makes sense in a prerouting chain of NAT type.
 
# ''redirect'' only makes sense in a prerouting chain of NAT type.
# You still have to register a postrouting nat chain, so the traffic is translated in the reply direction.


== NAT flags ==
== NAT flags ==
Line 100: Line 90:
% nft add rule nat postrouting masquerade random,persistent
% nft add rule nat postrouting masquerade random,persistent
% nft add rule nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat 1.2.3.4 fully-random
% nft add rule nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat 1.2.3.4 fully-random
</source>
== Inet family NAT ==
Since Linux kernel 5.2, there is support for performing stateful NAT in ''inet'' family chains. Syntax and semantics are equivalent to ''ip''/''ip6'' families; the only exception being if IP addresses are specified, a prefix of either ''ip'' or ''ip6'' to clarify the address family is required:
<source lang="bash">
% nft add rule inet nat prerouting dnat ip to 10.0.0.2
% nft add rule inet nat prerouting dnat ip6 to feed::c0fe
</source>
</source>



Revision as of 13:50, 27 November 2019

The nat chain type allows you to perform NAT. This chain type comes with special semantics:

  • The first packet of a flow is used to look up for a matching rule which sets up the NAT binding for this flow. This also manipulates this first packet accordingly.
  • No rule lookup happens for follow up packets in the flow: the NAT engine uses the NAT binding information already set up by the first packet to perform the packet manipulation.

Adding a NAT rule to a filter type chain will result in an error.

Stateful NAT

The stateful NAT involves the nf_conntrack kernel engine to match/set packet stateful information and will engage according to the state of connections. This is the most common way of performing NAT and the approach we recommend you to follow.

Be aware that with kernel versions before 4.18, you have to register the prerouting/postrouting chains even if you have no rules there since these chain will invoke the NAT engine for the packets coming in the reply direction. The remaining documentation in this article assumes a newer kernel which doesn't require this inconvenience anymore.

Source NAT

If you want to source NAT the traffic that leaves from your local area network to the Internet, you can create a new table nat with the postrouting chain:

% nft add table nat
% nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

Then, add the following rule:

% nft add rule nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat 1.2.3.4

This matches for all traffic from the 192.168.1.0/24 network to the interface eth0. The IPv4 address 1.2.3.4 is used as source for the packets that match this rule.

Destination NAT

You need to add the following table and chain configuration:

% nft add table nat
% nft add chain nat prerouting { type nat hook prerouting priority \-100 \; }

Then, you can add the following rule:

% nft add rule nat prerouting iif eth0 tcp dport { 80, 443 } dnat 192.168.1.120

This redirects the incoming traffic for TCP ports 80 and 443 to 192.168.1.120.

Masquerading

NOTE: masquerade is available starting with Linux Kernel 3.18.

Masquerade is a special case of SNAT, where the source address is automagically set to the address of the output interface. For example:

% nft add rule nat postrouting masquerade

Note that masquerade only makes sense from postrouting chain of NAT type.

Redirect

NOTE: redirect is available starting with Linux Kernel 3.19.

By using redirect, packets will be forwarded to local machine. Is a special case of DNAT where the destination is the current machine.

% nft add rule nat prerouting redirect

This example redirects 22/tcp traffic to 2222/tcp:

% nft add rule nat prerouting tcp dport 22 redirect to 2222

Note that: redirect only makes sense in a prerouting chain of NAT type.

NAT flags

Since Linux kernel 3.18, you can combine the following flags with your NAT statements:

  • random: randomize source port mapping.
  • fully-random: full port randomization.
  • persistent: gives a client the same source-/destination-address for each connection.

For example:

% nft add rule nat postrouting masquerade random,persistent
% nft add rule nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat 1.2.3.4 fully-random

Inet family NAT

Since Linux kernel 5.2, there is support for performing stateful NAT in inet family chains. Syntax and semantics are equivalent to ip/ip6 families; the only exception being if IP addresses are specified, a prefix of either ip or ip6 to clarify the address family is required:

% nft add rule inet nat prerouting dnat ip to 10.0.0.2
% nft add rule inet nat prerouting dnat ip6 to feed::c0fe

Incompatibilities

You cannot use iptables and nft to perform NAT at the same time. So make sure that the iptable_nat module is unloaded:

% rmmod iptable_nat

Stateless NAT

This type of NAT just modifies each packet according to your rules without any other state/connection tracking.

This is valid for 1:1 mappings and is faster than stateful NAT. However, it's easy to shoot yourself in the foot. If your environment doesn't require this approach, better stick to stateful NAT.

You have to disable connection tracking for modified packets.

The example below sets IP/port for each packet (also valid in IPv6):

% nft add rule ip raw prerouting ip protocol tcp ip daddr set 192.168.1.100 tcp dport set 10 notrack
% nft add rule ip6 raw prerouting ip6 nexthdr tcp ip6 daddr set fe00::1 tcp dport set 10 notrack

Be sure to check our documentation regarding mangling packets and setting packet connection tracking metainformation.

To use this feature you require nftables >=0.7 and linux kernel >= 4.9.