SNAT rewrite ip Pooling support
Nobody has claimed this yet.
- Dominant language
- ucode
- Stars
- 27
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
A config like this
config nat
option name 'SNAT'
option family 'ipv4'
option src 'vpn'
option src_ip '192.168.106.0/24'
option dest_ip '10.66.0.0/16'
option target 'SNAT'
option snat_ip '10.254.1.0/24'
list proto 'all'
Create this rule:
chain srcnat_vpn {
ip saddr 192.168.106.0/24 ip daddr 10.66.0.0/16 counter snat ip to 10.254.1.0 comment "!fw4: SNAT"
}
But it should create something like this:
chain srcnat_vpn {
ip saddr 192.168.106.0/24 ip daddr 10.66.0.0/16 counter snat ip to 10.254.1.0/24 comment "!fw4: SNAT"
}
NFT Tables support NAT pooling using a prefix or a range this is the link of the documentation NFT NAT pooling
I saw in the code the rip variable used for adding the snat rule is used as rip[0] so the prefix is been removed (this is correct only if a port rewrite is done, look at the example below) otherwise is supported.
You can also rewrite both an ip range + a port range and is defined like this:
chain srcnat_vpn {
ip saddr 192.168.106.0/24 ip daddr 10.0.0.0/24 tcp sport 19 tcp dport 12 counter snat ip to 10.254.1.1-10.254.1.2:100-200 comment "!fw4: TCP"
}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the code path that builds the SNAT rule and the use of the rip variable, then reproduce the issue with the configuration shown. Done means the generated nftables rule preserves the prefix for IP-only pooling while still supporting the documented IP-and-port range form.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100