3

There is only one table on the server - "nat" and it contains only two chains: "prerouting" and "postrouting". IP forwarding is enabled. I'm trying to set more specific conditions for the source nat rule. When I set the classic rule :

nft add rule nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat 1.2.3.4

everything works fine. But I'd like to specify also the interface where it's located for the network "saddr 192.168.1.0/24".

nft add rule nat postrouting **iif eth1** ip saddr 192.168.1.0/24 oif eth0 snat 1.2.3.4

When I enter this command, the program accepts it and the rule appears in the table. But the traffic doesn't go. Does anyone have any idea why?

Improve this question

1 Answer 1

Reset to default
1

This feature also requires kernel >= 5.5 for adequate netfilter support. Description in kernelnewbies.org:

Linux 5.5 was released on 26 Jan 2020

[...]

  • netfilter

    • Support iif matches in POSTROUTING commit

From the commit:

netfilter: Support iif matches in POSTROUTING

Instead of generally passing NULL to NF_HOOK_COND() for input device, pass skb->dev which contains input device for routed skbs.

Note that iptables (both legacy and nft) reject rules with input interface match from being added to POSTROUTING chains, but nftables allows this.

From the description, before this commit, the input interface was not provided by netfilter and the iif expression never matched.

Improve this answer
5
  • apparently so .. I turned out to be 5.4 version :)
    – Diem
    Commented Mar 31, 2021 at 7:24
  • Not in my answer but I double checked it worked (on kernel 5.10). Also for iptables (at least iptables-nft, didn't test with iptables-legacy) despite the commit's comment, as a workaround, using -i eth1 in an additional user chain called from POSTROUTING rather than using directly -i eth1 in POSTROUTING would work too.
    – A.B
    Commented Mar 31, 2021 at 8:22
  • updated to 5.11 and it worked) It's a pity that this does not work with the prerouting chain.
    – Diem
    Commented Mar 31, 2021 at 8:31
  • I mean, specify in the rule from which interface and from which network you can forward to which interface and which ip.For example like this : nft add rule nat prerouting iif ens33 ip daddr 0.0.0.0/0 tcp dport { 80, 443 } oif ens33 dnat to 192.168.200.200:8888
    – Diem
    Commented Mar 31, 2021 at 8:56
  • check this, but keep in mind that NAT alters addresses, which alters routing decision which might render result of the just-made FIB lookup not the final routing decision and thus "false". Probably not to be used in a NAT chain: manpages.debian.org/nftables/nft.8#FIB_EXPRESSIONS
    – A.B
    Commented Mar 31, 2021 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .