0

I am setting up a firewall + NAT using nftables (v0.9.6). The tool provides sets & maps to avoid a lot of rule duplication.

I want to use one common data structure (set or map) to configure both DNAT and filtering rules (forward).

When I try (nft --check -f example.conf), I always get an error. Do you know a way to do this without duplicating the NAT mapping into 2 data structures (one map & one set)?

Here is the example I use (see UPPERCASE COMMENTS).

These are the map & set:

table inet filter {
  map mymap {
    type inet_service : ipv4_addr
    elements = {
      12345 : 192.168.0.66,
      4321  : 192.168.0.77
    }
  }

  set myset {
    type ipv4_addr . inet_service
    elements = {
      192.168.0.66 . 12345,
      192.168.0.77 . 4321
    }
  }

And these are the rules:

  chain natprerouting {
    type nat hook prerouting priority dstnat; # =-100

    # ACCEPTED:
    dnat ip to tcp dport map @mymap

    # ERROR AT PARSING (unexpected string: @myset):
    dnat ip addr . port to @myset
  }

  chain forward {
    type filter hook forward priority filter; # =0

    # ERROR AT PARSING (unexpected dport):
    ip daddr tcp dport map @mymap accept

    # ACCEPTED:
    ip daddr . tcp dport @myset accept
  }
}

It would work if dnat to could accept a set. Can I convert a map into a set (or vice versa)? Is there a way?

1

1 Answer 1

1

There is no need to explicitly accept each DNATed connection in the forward chain, as connection tracking already knows about DNAT.

Just use ct status dnat accept like this instead:

table inet filter {
  chain forward {
    type filter hook forward priority filter; # =0

    # THIS ONE AUTOMATICALLY ACCEPTS ALL OUR DNATed PACKETS
    ct status dnat accept
  }
}

Some credit goes to Trent Buck from netfilter mailing list.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .