openwrt / openwrt/firewall4

SNAT rewrite ip Pooling support

Open
#71 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
ucode
Stars
27
Forks
37
PR merge metrics
No merged PRs in 30d

Description

A config like this

config nat
        option name 'SNAT'
        option family 'ipv4'
        option src 'vpn'
        option src_ip '192.168.106.0/24'
        option dest_ip '10.66.0.0/16'
        option target 'SNAT'
        option snat_ip '10.254.1.0/24'
        list proto 'all'

Create this rule:

	chain srcnat_vpn {
		ip saddr 192.168.106.0/24 ip daddr 10.66.0.0/16 counter snat ip to 10.254.1.0 comment "!fw4: SNAT"
	}

But it should create something like this:

	chain srcnat_vpn {
		ip saddr 192.168.106.0/24 ip daddr 10.66.0.0/16 counter snat ip to 10.254.1.0/24 comment "!fw4: SNAT"
	}

NFT Tables support NAT pooling using a prefix or a range this is the link of the documentation NFT NAT pooling

I saw in the code the rip variable used for adding the snat rule is used as rip[0] so the prefix is been removed (this is correct only if a port rewrite is done, look at the example below) otherwise is supported.

You can also rewrite both an ip range + a port range and is defined like this:

	chain srcnat_vpn {
		ip saddr 192.168.106.0/24 ip daddr 10.0.0.0/24 tcp sport 19 tcp dport 12 counter snat ip to 10.254.1.1-10.254.1.2:100-200 comment "!fw4: TCP"
	}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the code path that builds the SNAT rule and the use of the rip variable, then reproduce the issue with the configuration shown. Done means the generated nftables rule preserves the prefix for IP-only pooling while still supporting the documented IP-and-port range form.

Written by the indexing model from the issue text.

Assessment

Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.