How would I implement a masquerading rule like this iptables one in NFTables:

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

I've looked for it, but couldn't find out how to set the output interface

  • Did you not use this when migrating from iptables to nftables? {iptables-restore-translate -f save.txt > ruleset.nft nft -f ruleset.nft} – tad1073 2 days ago

You can write the rule this way:

nft add rule nat postrouting ip saddr oif eth0 masquerade

Take a look on nftables nat wiki for more informations.


as an aside, if you were masquerading under a dynamic address, you could simply

add rule nat postrouting oif ppp0 masquerade

oif / oifname

Userspace converts oif to integer at runtime

You should use probably use oifname (slower string matching) rather than oif if the interface might disappear and then re-appear (like ppp0 and others may, upon disconnect, etc.) unless you'll make other arrangements to masquerade upon the interface coming up each time.

oif → if the interface is removed and created again, the match will not occur as the index of added interfaces in kernel is monotonically increasing.

via nftables-quick-howto

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.