Configure NAT using nftables

With nftables, you can configure the masquerading, source (SNAT), destination NAT (DNAT), and redirect types. With NAT, you can modify the source or destination IP address.

NAT types
Copy link

The nftables framework supports different network address translation (NAT) types.

Masquerading and source NAT (SNAT)

Use one of these NAT types to change the source IP address of packets. For example, Internet Service Providers (ISPs) do not route private IP ranges, such as 10.0.0.0/8. If you use private IP ranges in your network and users should be able to reach servers on the internet, map the source IP address of packets from these ranges to a public IP address.

Masquerading and SNAT are very similar to one another. The differences are:

  • Masquerading automatically uses the IP address of the outgoing interface. Therefore, use masquerading if the outgoing interface uses a dynamic IP address.
  • SNAT sets the source IP address of packets to a specified IP and does not dynamically look up the IP of the outgoing interface. Therefore, SNAT is faster than masquerading. Use SNAT if the outgoing interface uses a fixed IP address.
Destination NAT (DNAT)
Use this NAT type to rewrite the destination address and port of incoming packets. For example, if your web server uses an IP address from a private IP range and is, therefore, not directly accessible from the internet, you can set a DNAT rule on the router to redirect incoming traffic to this server.
Redirect
This type is a special case of DNAT that redirects packets to the local machine depending on the chain hook. For example, if a service runs on a different port than its standard port, you can redirect incoming traffic from the standard port to this specific port.

Configure masquerading by using nftables
Copy link

Masquerading enables a router to dynamically change the source IP of packets sent through an interface to the IP address of the interface. This means that if the interface gets a new IP assigned, nftables automatically uses the new IP when replacing the source IP.

About this task
Copy link

Replace the source IP of packets leaving the host through the ens3 interface to the IP set on ens3.

Procedure
Copy link

  1. Create a table: 
    # nft add table nat
  2. Add the postrouting chain to the table: 
    # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
  3. Add a rule to the postrouting chain that matches outgoing packets on the ens3 interface: 
    # nft add rule nat postrouting oifname "ens3" masquerade
    Important

    You can only use real interface names in iifname and oifname parameters, and alternative names (altname) are not supported.

Configure source NAT using nftables
Copy link

On a router, you can use Source NAT (SNAT) to change the IP of packets sent through an interface to a specific IP address. The router then replaces the source IP of outgoing packets.

Procedure
Copy link

  1. Create a table: 
    # nft add table nat
  2. Add the postrouting chain to the table: 
    # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
  3. Add a rule to the postrouting chain that replaces the source IP of outgoing packets through ens3 with 192.0.2.1: 
    # nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1

Configure destination NAT using nftables
Copy link

Use Destination NAT (DNAT) to redirect traffic on a router to a host that is not directly accessible from the internet.

About this task
Copy link

For example, with DNAT the router redirects incoming traffic sent to port 80 and 443 to a web server with the IP address 192.0.2.1.

Procedure
Copy link

  1. Create a table: 
    # nft add table nat
  2. Add the prerouting and postrouting chains to the table: 
    # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
# nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

    Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

  3. Add a rule to the prerouting chain that redirects incoming traffic to port 80 and 443 on the ens3 interface of the router to the web server with the IP address 192.0.2.1: 
    # nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1
  4. Depending on your environment, add either a SNAT or masquerading rule to change the source address for packets returning from the web server to the sender:
    1. If the ens3 interface uses a dynamic IP addresses, add a masquerading rule: 
      # nft add rule nat postrouting oifname "ens3" masquerade
    2. If the ens3 interface uses a static IP address, add a SNAT rule. For example, if the ens3 uses the 198.51.100.1 IP address: 
      # nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1
  5. Enable packet forwarding: 
    # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
# sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

Configure a redirect using nftables
Copy link

The redirect feature is a special case of destination network address translation (DNAT) that redirects packets to the local machine depending on the chain hook.

About this task
Copy link

For example, you can redirect incoming and forwarded traffic sent to port 22 of the local host to port 2222.

Procedure
Copy link

  1. Create a table: 
    # nft add table nat
  2. Add the prerouting chain to the table: 
    # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }

    Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

  3. Add a rule to the prerouting chain that redirects incoming traffic on port 22 to port 2222: 
    # nft add rule nat prerouting tcp dport 22 redirect to 2222