6.6. Configuring port forwarding using nftables

Procedure 6.17. Forwarding incoming packets to a different local port

1. Create a table named nat with the ip address family:

   # nft add table ip nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; }

   Note

   Pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.
3. Add a rule to the prerouting chain that redirects incoming packets on port 8022 to the local port 22:

   # nft add rule ip nat prerouting tcp dport 8022 redirect to :22

Procedure 6.18. Forwarding incoming packets on a specific local port to a different host

1. Create a table named nat with the ip address family:

   # nft add table ip nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }

   Note

   Pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.
3. Add a rule to the prerouting chain that redirects incoming packets on port 443 to the same port on 192.0.2.1:

   # nft add rule ip nat prerouting tcp dport 443 dnat to 192.0.2.1

4. Add a rule to the postrouting chain to masquerade outgoing traffic:

   # nft add rule ip nat postrouting ip daddr 192.0.2.1 masquerade

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf