Maps - Revision history

Fmyhr: Use "snat to" and "dnat to".

2021-04-20T01:49:59Z

Use "snat to" and "dnat to".

← Older revision		Revision as of 01:49, 20 April 2021
Line 9:		Line 9:

	<source lang="bash">		<source lang="bash">
	% nft add rule ip nat prerouting dnat tcp dport map { 80 : 192.168.1.100, 8888 : 192.168.1.101 }		% nft add rule ip nat prerouting dnat to tcp dport map { 80 : 192.168.1.100, 8888 : 192.168.1.101 }
	</source>		</source>

Line 30:		Line 30:

	<source lang="bash">		<source lang="bash">
	% nft add rule ip nat postrouting snat tcp dport map @porttoip		% nft add rule ip nat postrouting snat to tcp dport map @porttoip
	</source>		</source>

	Now outgoing packets to TCP/80 use source IP address 192.168.1.100, those to TCP/8888 are SNAT'ed to 192.168.1.101. We can easily adjust our SNAT at anytime simply by adding or deleting elements in ''porttoip''.		Now outgoing packets to TCP/80 use source IP address 192.168.1.100, those to TCP/8888 are SNAT'ed to 192.168.1.101. We can easily adjust our SNAT at anytime simply by adding or deleting elements in ''porttoip''.

Fmyhr: More precise link to "set" instead of nonexistent "generic set infrastructure" page.

2021-04-09T15:14:21Z

More precise link to "set" instead of nonexistent "generic set infrastructure" page.

← Older revision		Revision as of 15:14, 9 April 2021
Line 1:		Line 1:
	An nftables map stores key-value pairs, like [https://en.wikipedia.org/wiki/Associative_array associative arrays / dictionaries / hashes] do in many programming languages. In an nftables rule you can specify a packet field (e.g. ''tcp dport'') and reference a map to search for the map element whose key matches the packet field's value, and return that map element's value (or failure if the map contains no matching element). Some examples below will help clarify this general description.		An nftables map stores key-value pairs, like [https://en.wikipedia.org/wiki/Associative_array associative arrays / dictionaries / hashes] do in many programming languages. In an nftables rule you can specify a packet field (e.g. ''tcp dport'') and reference a map to search for the map element whose key matches the packet field's value, and return that map element's value (or failure if the map contains no matching element). Some examples below will help clarify this general description.

	You can think of a map as a set that returns a value instead of just an "in set / not in set" result. Behind the scenes both sets and maps use the same ~~[[Sets \|~~ generic set infrastructure]] and therefore share many of the same options and semantics.		You can think of a map as a [[Sets\|set]] that returns a value instead of just an "in set / not in set" result. Behind the scenes both sets and maps use the same generic set infrastructure and therefore share many of the same options and semantics.

Fmyhr: Rewrote intro section to try to explain map concept clearly.

2021-04-03T16:02:16Z

Rewrote intro section to try to explain map concept clearly.

← Older revision		Revision as of 16:02, 3 April 2021
Line 1:		Line 1:
	~~You can use~~ an nftables map to ~~look up a~~ value that ~~corresponds to~~ the value of ~~a defined key~~. ~~Maps~~ use the [[Sets \| generic set infrastructure]] and therefore share many of the same options and semantics.		An nftables map stores key-value pairs, like [https://en.wikipedia.org/wiki/Associative_array associative arrays / dictionaries / hashes] do in many programming languages. In an nftables rule you can specify a packet field (e.g. ''tcp dport'') and reference a map to search for the map element whose key matches the packet field's value, and return that map element's value (or failure if the map contains no matching element). Some examples below will help clarify this general description.

			You can think of a map as a set that returns a value instead of just an "in set / not in set" result. Behind the scenes both sets and maps use the same [[Sets \| generic set infrastructure]] and therefore share many of the same options and semantics.


	= Anonymous maps =		= Anonymous maps =

Fmyhr: Edited for clarity, linked NAT and data types pages.

2021-02-15T23:28:06Z

Edited for clarity, linked NAT and data types pages.

← Older revision		Revision as of 23:28, 15 February 2021
Line 1:		Line 1:
	~~Maps are yet another interesting feature that has been in ''nftables'' since the very beginning.~~ You can use a map to look up ~~for data based on some specific~~ key ~~that is used as input~~. Maps ~~internally~~ use the [[Sets \| generic set infrastructure]] and therefore share ~~some~~ of ~~their~~ options and semantics.		You can use an nftables map to look up a value that corresponds to the value of a defined key. Maps use the [[Sets \| generic set infrastructure]] and therefore share many of the same options and semantics.

	= ~~Literal~~ maps =		= Anonymous maps =

	The following ~~example shows how the destination TCP port selects the~~ destination IP ~~address to DNAT~~ the packet:		The following rule uses a map to [[Performing_Network_Address_Translation_(NAT)\|DNAT]] packets to different destination IP addresses depending on the packet's destination tcp port:

	<source lang="bash">		<source lang="bash">
Line 9:		Line 9:
	</source>		</source>

	This is ~~how you can express~~ a classical port redirection when the real ~~server~~ are ~~actually~~ located behind ~~the~~ firewall. ~~This~~ can be read as it follows:		This is a very concise and efficient way to perform classical port redirection when the real servers are located behind a firewall. It can be read as it follows:

	* If the TCP destination port is 80, then the packet is DNAT'ed to 192.168.1.100.		* If the TCP destination port is 80, then the packet is DNAT'ed to 192.168.1.100.
	* If the TCP destination port is 8888, then the packet is DNAT'ed to 192.168.1.101.		* If the TCP destination port is 8888, then the packet is DNAT'ed to 192.168.1.101.

	~~= Map declarations =~~

	You can also declare maps ~~that~~ you can ~~populate in a dynamic fashion~~, ~~eg.~~		= Named maps =

			You can also declare named maps, to which you can then add or delete elements at anytime. For example, with:

	<source lang="bash">		<source lang="bash">
Line 23:		Line 24:
	</source>		</source>

	~~The example above shows that the~~ ''porttoip'' map ~~maintains~~ the ~~corresponde between Internet services (which~~ is the ~~datatype of a TCP~~ destination ~~port) and~~ IP addresses.		we first define a map ''porttoip'' which looks up an IP address based on a UDP or TCP port number, and then add a couple of elements. The map itself only cares about the [[Data_types\|data types]] of its keys and values. It is up to us to use meaningful values for both, and to use the map appropriately in rules. In this example we use ''porttoip'' to map tcp destination ports to source IP addresses. Then we can perform [[Performing_Network_Address_Translation_(NAT)\|SNAT]] using the rule:

	Then~~, you~~ can ~~use it from a~~ rule ~~like~~:

	<source lang="bash">		<source lang="bash">
Line 31:		Line 30:
	</source>		</source>

	~~This rules tells that the~~ source IP address ~~that is used for~~ SNAT ~~depends on TCP destination port~~. ~~The content of the map~~ can ~~be dynamically updated~~ by adding ~~new~~ elements.		Now outgoing packets to TCP/80 use source IP address 192.168.1.100, those to TCP/8888 are SNAT'ed to 192.168.1.101. We can easily adjust our SNAT at anytime simply by adding or deleting elements in ''porttoip''.

Arturo: add link to sets

2020-09-07T11:02:20Z

add link to sets

← Older revision		Revision as of 11:02, 7 September 2020
Line 1:		Line 1:
	Maps are yet another interesting feature that has been in ''nftables'' since the very beginning. You can use a map to look up for data based on some specific key that is used as input. Maps internally use the generic set infrastructure.		Maps are yet another interesting feature that has been in ''nftables'' since the very beginning. You can use a map to look up for data based on some specific key that is used as input. Maps internally use the [[Sets \| generic set infrastructure]] and therefore share some of their options and semantics.

	= Literal maps =		= Literal maps =

Pablo: Created page with "Maps are yet another interesting feature that has been in ''nftables'' since the very beginning. You can use a map to look up for data based on some specific key that is used..."

2016-07-13T17:55:34Z

Created page with "Maps are yet another interesting feature that has been in ''nftables'' since the very beginning. You can use a map to look up for data based on some specific key that is used..."

New page

Maps are yet another interesting feature that has been in ''nftables'' since the very beginning. You can use a map to look up for data based on some specific key that is used as input. Maps internally use the generic set infrastructure.

= Literal maps =

The following example shows how the destination TCP port selects the destination IP address to DNAT the packet:

<source lang="bash">
% nft add rule ip nat prerouting dnat tcp dport map { 80 : 192.168.1.100, 8888 : 192.168.1.101 }
</source>

This is how you can express a classical port redirection when the real server are actually located behind the firewall. This can be read as it follows:

* If the TCP destination port is 80, then the packet is DNAT'ed to 192.168.1.100.
* If the TCP destination port is 8888, then the packet is DNAT'ed to 192.168.1.101.

= Map declarations =

You can also declare maps that you can populate in a dynamic fashion, eg.

<source lang="bash">
% nft add map nat porttoip { type inet_service: ipv4_addr\; }
% nft add element nat porttoip { 80 : 192.168.1.100, 8888 : 192.168.1.101 }
</source>

The example above shows that the ''porttoip'' map maintains the corresponde between Internet services (which is the datatype of a TCP destination port) and IP addresses.

Then, you can use it from a rule like:

<source lang="bash">
% nft add rule ip nat postrouting snat tcp dport map @porttoip
</source>

This rules tells that the source IP address that is used for SNAT depends on TCP destination port. The content of the map can be dynamically updated by adding new elements.