Este conteúdo não está disponível no idioma selecionado.
6.3. Configuring NAT using nftables
With
nftables, you can configure the following network address translation (NAT) types:
- Masquerading
- Source NAT (
SNAT) - Destination NAT (
DNAT) - Redirect
6.3.1. The different NAT types: masquerading, source NAT, destination NAT, and redirect
These are the different network address translation (
NAT) types:
Masquerading and source NAT (SNAT)
Use one of these
NAT types to change the source IP address of packets. For example, Internet Service Providers do not route private IP ranges, such as 10.0.0.0/8. If you use private IP ranges in your network and users should be able to reach servers on the Internet, map the source IP address of packets from these ranges to a public IP address.
Both masquerading and
SNAT are very similar. The differences are:
- Masquerading automatically uses the IP address of the outgoing interface. Therefore, use masquerading if the outgoing interface uses a dynamic IP address.
SNATsets the source IP address of packets to a specified IP and does not dynamically look up the IP of the outgoing interface. Therefore,SNATis faster than masquerading. UseSNATif the outgoing interface uses a fixed IP address.
Destination NAT (DNAT)
Use this
NAT type to route incoming traffic to a different host. For example, if your web server uses an IP address from a reserved IP range and is, therefore, not directly accessible from the Internet, you can set a DNAT rule on the router to redirect incoming traffic to this server.
Redirect
This type is a special case of DNAT that redirects packets to the local machine depending on the chain hook. For example, if a service runs on a different port than its standard port, you can redirect incoming traffic from the standard port to this specific port.
6.3.2. Configuring masquerading using nftables
Masquerading enables a router to dynamically change the source IP of packets sent through an interface to the IP address of the interface. This means that if the interface gets a new IP assigned,
nftables automatically uses the new IP when replacing the source IP.
The following procedure describes how to replace the source IP of packets leaving the host through the
ens3 interface to the IP set on ens3.
Procedure 6.9. Configuring masquerading using nftables
- Create a table:
# nft add table nat - Add the
preroutingandpostroutingchains to the table:# nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; } # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
Important
Even if you do not add a rule to thepreroutingchain, thenftablesframework requires this chain to match incoming packet replies.Note that you must pass the--option to thenftcommand to avoid that the shell interprets the negative priority value as an option of thenftcommand. - Add a rule to the
postroutingchain that matches outgoing packets on theens3interface:# nft add rule nat postrouting oifname "ens3" masquerade
6.3.3. Configuring source NAT using nftables
On a router, Source NAT (
SNAT) enables you to change the IP of packets sent through an interface to a specific IP address.
The following procedure describes how to replace the source IP of packets leaving the router through the
ens3 interface to 192.0.2.1.
Procedure 6.10. Configuring source NAT using nftables
- Create a table:
# nft add table nat - Add the
preroutingandpostroutingchains to the table:# nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; } # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
Important
Even if you do not add a rule to thepreroutingchain, thenftablesframework requires this chain to match outgoing packet replies.Note that you must pass the--option to thenftcommand to avoid that the shell interprets the negative priority value as an option of thenftcommand. - Add a rule to the
postroutingchain that replaces the source IP of outgoing packets throughens3with192.0.2.1:# nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1
Additional resources
- For more information, see Section 6.6.2, “Forwarding incoming packets on a specific local port to a different host”
6.3.4. Configuring destination NAT using nftables
Destination
NAT enables you to redirect traffic on a router to a host that is not directly accessible from the Internet.
The following procedure describes how to redirect incoming traffic sent to port
80 and 443 of the router to the host with the 192.0.2.1 IP address.
Procedure 6.11. Configuring destination NAT using nftables
- Create a table:
# nft add table nat - Add the
preroutingandpostroutingchains to the table:# nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; } # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
Important
Even if you do not add a rule to the postrouting chain, thenftablesframework requires this chain to match outgoing packet replies.Note that you must pass the--option to thenftcommand to avoid that the shell interprets the negative priority value as an option of thenftcommand. - Add a rule to the prerouting chain that redirects incoming traffic on the
ens3interface sent to port 80 and 443 to the host with the 192.0.2.1 IP:# nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1
- Depending on your environment, add either a SNAT or masquerading rule to change the source address:
- If the
ens3interface used dynamic IP addresses, add a masquerading rule:# nft add rule nat postrouting oifname "ens3" masquerade
- If the
ens3interface uses a static IP address, add aSNATrule. For example, if theens3uses the 198.51.100.1 IP address:# nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1
Additional resources
- For more information, see Section 6.3.1, “The different NAT types: masquerading, source NAT, destination NAT, and redirect”
6.3.5. Configuring a redirect using nftables
The
redirect feature is a special case of destination network address translation (DNAT) that redirects packets to the local machine depending on the chain hook.
The following procedure describes how to redirect incoming and forwarded traffic sent to port 22 of the local host to port 2222.
Procedure 6.12. Configuring a redirect using nftables
- Create a table:
# nft add table nat
- Add the prerouting chain to the table:
# nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }Note that you must pass the--option to thenftcommand to avoid that the shell interprets the negative priority value as an option of thenftcommand. - Add a rule to the prerouting chain that redirects incoming traffic on port 22 to port 2222:
# nft add rule nat prerouting tcp dport 22 redirect to 2222
Additional resources
- For more information, see Section 6.3.1, “The different NAT types: masquerading, source NAT, destination NAT, and redirect”
