How would I implement a masquerading rule like this iptables one in NFTables:

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

I've looked for it, but couldn't find out how to set the output interface

  • 1
    Did you not use this when migrating from iptables to nftables? {iptables-restore-translate -f save.txt > ruleset.nft nft -f ruleset.nft}
    – tad1073
    Commented Aug 22, 2019 at 0:06

3 Answers 3


You can write the rule this way:

nft add rule nat postrouting ip saddr oif eth0 masquerade

Take a look on nftables nat wiki for more informations.


as an aside, if you were masquerading under a dynamic address, you could simply

add rule nat postrouting oif ppp0 masquerade

oif / oifname

Userspace converts oif to integer at runtime

You should use probably use oifname (slower string matching) rather than oif if the interface might disappear and then re-appear (like ppp0 and others may, upon disconnect, etc.) unless you'll make other arrangements to masquerade upon the interface coming up each time.

oif → if the interface is removed and created again, the match will not occur as the index of added interfaces in kernel is monotonically increasing.

via nftables-quick-howto


I have the following "nat" table in my /etc/nftables.conf file, along with my other firewall rules which are in a separate "filter" table :

table ip nat {
    chain prerouting {
        type nat hook prerouting priority filter; policy accept;
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        oifname { "eno2" } masquerade   # "eno2" is our external interface

table ip filter {
    # etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .