2.5. Configuring NAT using nftables

Procedure

1. Create a table:

   # nft add table nat

2. Add the postrouting chain to the table:

   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

3. Add a rule to the postrouting chain that matches outgoing packets on the ens3 interface:

   # nft add rule nat postrouting oifname "ens3" masquerade

   重要

   You can only use real interface names in iifname and oifname parameters, and alternative names (altname) are not supported.

Procedure

1. Create a table:

   # nft add table nat

2. Add the postrouting chain to the table:

   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

3. Add a rule to the postrouting chain that replaces the source IP of outgoing packets through ens3 with 192.0.2.1:

   # nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic to port 80 and 443 on the ens3 interface of the router to the web server with the IP address 192.0.2.1:

   # nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1

4. Depending on your environment, add either a SNAT or masquerading rule to change the source address for packets returning from the web server to the sender:

   1. If the ens3 interface uses a dynamic IP addresses, add a masquerading rule:

      # nft add rule nat postrouting oifname "ens3" masquerade

   2. If the ens3 interface uses a static IP address, add a SNAT rule. For example, if the ens3 uses the 198.51.100.1 IP address:

      # nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting chain to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic on port 22 to port 2222:

   # nft add rule nat prerouting tcp dport 22 redirect to 2222