Multiple NATs using nftables maps: Difference between revisions
Jump to navigation
Jump to search
(Created page with "Thanks to nftables Maps, if you have a previous iptables NAT (destination NAT) ruleset like this: <source lang="bash"> % iptables -t nat -A PREROUTING -p tcp --dport 1000...") |
(add see also section with pointer to general docs on NAT) |
||
| Line 29: | Line 29: | ||
ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 } | ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 } | ||
</source> | </source> | ||
== See also == | |||
* [[Performing_Network_Address_Translation_(NAT) | Performing NAT with nftables]] | |||
Revision as of 12:02, 28 August 2020
Thanks to nftables Maps, if you have a previous iptables NAT (destination NAT) ruleset like this:
% iptables -t nat -A PREROUTING -p tcp --dport 1000 -j DNAT --to-destination 1.1.1.1:1234
% iptables -t nat -A PREROUTING -p udp --dport 2000 -j DNAT --to-destination 2.2.2.2:2345
% iptables -t nat -A PREROUTING -p tcp --dport 3000 -j DNAT --to-destination 3.3.3.3:3456
It can be easily translated to nftables in a single line:
% nft add rule nat prerouting dnat \
tcp dport map { 1000 : 1.1.1.1, 2000 : 2.2.2.2, 3000 : 3.3.3.3} \
: tcp dport map { 1000 : 1234, 2000 : 2345, 3000 : 3456 }
Likewise, in iptables NAT (source NAT):
% iptables -t nat -A POSTROUTING -s 192.168.1.1 -j SNAT --to-source 1.1.1.1
% iptables -t nat -A POSTROUTING -s 192.168.2.2 -j SNAT --to-source 2.2.2.2
% iptables -t nat -A POSTROUTING -s 192.168.3.3 -j SNAT --to-source 3.3.3.3
Translated to a nftables one-liner:
% nft add rule nat postrouting snat \
ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 }