From 6908a677ba04c7c714b2e8b1368ec79ea1ebc07b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 2 May 2017 19:51:27 +0200 Subject: nft.8: Enhance NAT documentation This adds documentation about masquerade and redirect statements, points out that for any NAT statement both prerouting and postrouting chains are required and adds a bunch of examples to the section's end. Signed-off-by: Phil Sutter Acked-by: Arturo Borrero Gonzalez Signed-off-by: Pablo Neira Ayuso --- doc/nft.xml | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 57 insertions(+), 1 deletion(-) (limited to 'doc') diff --git a/doc/nft.xml b/doc/nft.xml index 4d0e89cd..5680cdf1 100644 --- a/doc/nft.xml +++ b/doc/nft.xml @@ -4121,12 +4121,45 @@ ct eventmask set new or related or destroy :port - port persistent, random, fully-random + + masquerade + to + :port + persistent, random, fully-random + + + masquerade + to + :port - port + persistent, random, fully-random + + + redirect + to + :port + persistent, random, fully-random + + + redirect + to + :port - port + persistent, random, fully-random + The nat statements are only valid from nat chain types. - The snat statement is only valid in the postrouting and input hooks, it specifies that the source address of the packet should be modified. The dnat statement is only valid in the prerouting and output chains, it specifies that the destination address of the packet should be modified. You can use non-base chains which are called from base chains of nat chain type too. All future packets in this connection will also be mangled, and rules should cease being examined. + The snat and masquerade statements specify that the source address of the packet should be modified. While snat is only valid in the postrouting and input chains, masquerade makes sense only in postrouting. The dnat and redirect statements are only valid in the prerouting and output chains, they specify that the destination address of the packet should be modified. You can use non-base chains which are called from base chains of nat chain type too. All future packets in this connection will also be mangled, and rules should cease being examined. + + + The masquerade statement is a special form of snat which always uses the outgoing interface's IP address to translate to. It is particularly useful on gateways with dynamic (public) IP addresses. + + + The redirect statement is a special form of dnat which always translates the destination address to the local host's one. It comes in handy if one only wants to alter the destination port of incoming traffic on different interfaces. + + + Note that all nat statements require both prerouting and postrouting base chains to be present since otherwise packets on the return path won't be seen by netfilter and therefore no reverse translation will take place. @@ -4183,7 +4216,30 @@ ct eventmask set new or related or destroy
+ + + + Using NAT statements + +# create a suitable table/chain setup for all further examples +add table nat +add chain nat prerouting { type nat hook prerouting priority 0; } +add chain nat postrouting { type nat hook postrouting priority 100; } + +# translate source addresses of all packets leaving via eth0 to address 1.2.3.4 +add rule nat postrouting oif eth0 snat to 1.2.3.4 +# redirect all traffic entering via eth0 to destination address 192.168.1.120 +add rule nat prerouting iif eth0 dnat to 192.168.1.120 + +# translate source addresses of all packets leaving via eth0 to whatever +# locally generated packets would use as source to reach the same destination +add rule nat postrouting oif eth0 masquerade + +# redirect incoming TCP traffic for port 22 to port 2222 +add rule nat prerouting tcp dport 22 redirect to :2222 + + -- cgit v1.2.3