Multiple NATs using nftables maps - Revision history

Pablo: /* Multiple NAT mapping with address and port */

2021-06-21T12:56:35Z

Multiple NAT mapping with address and port

← Older revision		Revision as of 12:56, 21 June 2021
Line 47:		Line 47:

	<source lang="bash">		<source lang="bash">
	% nft add rule nat pre ip protocol udp dnat ip addr . port to udp dport map { 1100 : 192.168.1.2 . 5061, 1101 : 192.168.1.3 . 5061, 1400 : 192.168.1.4 . 5061 }		% nft add rule nat pre ip protocol udp dnat ip addr . port to udp dport map { \
			1100 : 192.168.1.2 . 5061, \
			1101 : 192.168.1.3 . 5061, \
			1400 : 192.168.1.4 . 5061 \
			}
	</source>		</source>

Pablo: /* Multiple NAT mapping with address and port */ missing source tag

2021-06-21T12:56:08Z

Multiple NAT mapping with address and port: missing source tag

← Older revision		Revision as of 12:56, 21 June 2021
Line 46:		Line 46:
	If your mapping does not need to be updated, you could use a anonymous map in your rule instead:		If your mapping does not need to be updated, you could use a anonymous map in your rule instead:

			<source lang="bash">
	% nft add rule nat pre ip protocol udp dnat ip addr . port to udp dport map { 1100 : 192.168.1.2 . 5061, 1101 : 192.168.1.3 . 5061, 1400 : 192.168.1.4 . 5061 }		% nft add rule nat pre ip protocol udp dnat ip addr . port to udp dport map { 1100 : 192.168.1.2 . 5061, 1101 : 192.168.1.3 . 5061, 1400 : 192.168.1.4 . 5061 }
			</source>

	== See also ==		== See also ==

	* [[Performing_Network_Address_Translation_(NAT) \| Performing NAT with nftables]]		* [[Performing_Network_Address_Translation_(NAT) \| Performing NAT with nftables]]

Pablo: /* Multiple NAT mapping with address and port */ add example for anonymous map

2021-06-21T12:55:39Z

Multiple NAT mapping with address and port: add example for anonymous map

← Older revision		Revision as of 12:55, 21 June 2021
Line 43:		Line 43:
	% nft add rule nat pre ip protocol udp dnat ip addr . port to udp dport map @foo		% nft add rule nat pre ip protocol udp dnat ip addr . port to udp dport map @foo
	</source>		</source>

			If your mapping does not need to be updated, you could use a anonymous map in your rule instead:

			% nft add rule nat pre ip protocol udp dnat ip addr . port to udp dport map { 1100 : 192.168.1.2 . 5061, 1101 : 192.168.1.3 . 5061, 1400 : 192.168.1.4 . 5061 }

	== See also ==		== See also ==

	* [[Performing_Network_Address_Translation_(NAT) \| Performing NAT with nftables]]		* [[Performing_Network_Address_Translation_(NAT) \| Performing NAT with nftables]]

Pablo: /* multiple NAT mapping with address and port */ minor comestic

2021-06-21T12:43:37Z

multiple NAT mapping with address and port: minor comestic

← Older revision		Revision as of 12:43, 21 June 2021
Line 30:		Line 30:
	</source>		</source>

	= ~~multiple~~ NAT mapping with address and port =		= Multiple NAT mapping with address and port =

	You might also need to define a NAT mapping that includes the IP address and port ~~mapping~~, such as:		You might also need to define a NAT mapping that includes the IP address and port, such as:

	<source lang="bash">		<source lang="bash">

Pablo: multiple NAT mapping with address and port

2021-06-21T12:42:09Z

multiple NAT mapping with address and port

@@ Line 28: / Line 28: @@
 % nft add rule nat postrouting snat to \
        ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 }
 </source>

Fmyhr: "{snat|dnat} " -> "{snat|dnat} to }"

2021-04-20T01:45:49Z

"{snat|dnat} <ip_addr>" -> "{snat|dnat} to <ip_addr>}"

← Older revision		Revision as of 01:45, 20 April 2021
Line 10:		Line 10:

	<source lang="bash">		<source lang="bash">
	% nft add rule nat prerouting dnat \		% nft add rule nat prerouting dnat to \
	tcp dport map { 1000 : 1.1.1.1, 2000 : 2.2.2.2, 3000 : 3.3.3.3} \		tcp dport map { 1000 : 1.1.1.1, 2000 : 2.2.2.2, 3000 : 3.3.3.3} \
	: tcp dport map { 1000 : 1234, 2000 : 2345, 3000 : 3456 }		: tcp dport map { 1000 : 1234, 2000 : 2345, 3000 : 3456 }
Line 26:		Line 26:

	<source lang="bash">		<source lang="bash">
	% nft add rule nat postrouting snat \		% nft add rule nat postrouting snat to \
	ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 }		ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 }
	</source>		</source>

Arturo: add see also section with pointer to general docs on NAT

2020-08-28T11:02:09Z

add see also section with pointer to general docs on NAT

← Older revision		Revision as of 11:02, 28 August 2020
Line 29:		Line 29:
	ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 }		ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 }
	</source>		</source>

			== See also ==

			* [[Performing_Network_Address_Translation_(NAT) \| Performing NAT with nftables]]

Pablo: Created page with "Thanks to nftables Maps, if you have a previous iptables NAT (destination NAT) ruleset like this: % iptables -t nat -A PREROUTING -p tcp --dport 1000..."

2016-07-13T17:53:15Z

Created page with "Thanks to nftables Maps, if you have a previous iptables NAT (destination NAT) ruleset like this: <source lang="bash"> % iptables -t nat -A PREROUTING -p tcp --dport 1000..."

New page

Thanks to nftables [[Maps]], if you have a previous iptables NAT (destination NAT) ruleset like this:

<source lang="bash">
% iptables -t nat -A PREROUTING -p tcp --dport 1000 -j DNAT --to-destination 1.1.1.1:1234
% iptables -t nat -A PREROUTING -p udp --dport 2000 -j DNAT --to-destination 2.2.2.2:2345
% iptables -t nat -A PREROUTING -p tcp --dport 3000 -j DNAT --to-destination 3.3.3.3:3456
</source>

It can be easily translated to nftables in a single line:

<source lang="bash">
% nft add rule nat prerouting dnat \
tcp dport map { 1000 : 1.1.1.1, 2000 : 2.2.2.2, 3000 : 3.3.3.3} \
: tcp dport map { 1000 : 1234, 2000 : 2345, 3000 : 3456 }
</source>

Likewise, in iptables NAT (source NAT):

<source lang="bash">
% iptables -t nat -A POSTROUTING -s 192.168.1.1 -j SNAT --to-source 1.1.1.1
% iptables -t nat -A POSTROUTING -s 192.168.2.2 -j SNAT --to-source 2.2.2.2
% iptables -t nat -A POSTROUTING -s 192.168.3.3 -j SNAT --to-source 3.3.3.3
</source>

Translated to a nftables one-liner:

<source lang="bash">
% nft add rule nat postrouting snat \
ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 }
</source>