6.3. Configuring NAT using nftables

Procedure 6.9. Configuring masquerading using nftables

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap
2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Copy to Clipboard Toggle word wrap

   Important

   Even if you do not add a rule to the prerouting chain, the nftables framework requires this chain to match incoming packet replies.
   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.
3. Add a rule to the postrouting chain that matches outgoing packets on the ens3 interface:

   # nft add rule nat postrouting oifname "ens3" masquerade

   Copy to Clipboard Toggle word wrap

Procedure 6.10. Configuring source NAT using nftables

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap
2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Copy to Clipboard Toggle word wrap

   Important

   Even if you do not add a rule to the prerouting chain, the nftables framework requires this chain to match outgoing packet replies.
   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.
3. Add a rule to the postrouting chain that replaces the source IP of outgoing packets through ens3 with 192.0.2.1:

   # nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1

   Copy to Clipboard Toggle word wrap

Procedure 6.11. Configuring destination NAT using nftables

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap
2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
   

   Copy to Clipboard Toggle word wrap

   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.
   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.
3. Add a rule to the prerouting chain that redirects incoming traffic on the ens3 interface sent to port 80 and 443 to the host with the 192.0.2.1 IP:

   # nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1

   Copy to Clipboard Toggle word wrap
4. Depending on your environment, add either a SNAT or masquerading rule to change the source address:
   1. If the ens3 interface used dynamic IP addresses, add a masquerading rule:

      # nft add rule nat postrouting oifname "ens3" masquerade

      Copy to Clipboard Toggle word wrap
   2. If the ens3 interface uses a static IP address, add a SNAT rule. For example, if the ens3 uses the 198.51.100.1 IP address:

      # nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1

      Copy to Clipboard Toggle word wrap

Procedure 6.12. Configuring a redirect using nftables

1. Create a table:

   # nft add table nat

   Copy to Clipboard Toggle word wrap
2. Add the prerouting chain to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }

   Copy to Clipboard Toggle word wrap
   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.
3. Add a rule to the prerouting chain that redirects incoming traffic on port 22 to port 2222:

   # nft add rule nat prerouting tcp dport 22 redirect to 2222

   Copy to Clipboard Toggle word wrap