<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span> changed
<a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - Nft stateless NAT (NOTRACK)"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1213">bug 1213</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>NEW
</td>
<td>ASSIGNED
</td>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>fw@strlen.de, pablo@netfilter.org
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - Nft stateless NAT (NOTRACK)"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1213#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - Nft stateless NAT (NOTRACK)"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1213">bug 1213</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>(In reply to Myeongsu Kim from <a href="show_bug.cgi?id=1213#c0">comment #0</a>)
<span class="quote">> I use Ubuntu 17.10 (nftables 0.8, kernel 4.13)
>
> NOTRACK is used to turn off connection tracking for all packets matching this
> rule. For example, in iptables:
>
> iptables -t raw -I PREROUTING -j NOTRACK
>
>
> I'd like to use stateless NAT (1:1)instead of iptables.
>
> nft add table NAT
> nft add chain NAT prerouting {type nat hook prerouting priority - 300 \; }
> nft add chain NAT postrouting {type nat hook postrouting priority - 300 \; }
> nft add rule NAT prerouting counter
> nft add rule NAT prerouting ip daddr 192.168.204.60 notrack counter
> nft add rule NAT prerouting counter
>
> The counter value of prerouting is zero.
>
> table ip NAT{
> chain prerouting {
> counter packets 0 bytes 0
> ip daddr 192.168.204.60 notrack counter packets 0 bytes 0
> counter packets 0 bytes 0
> }
>
> Thanks,</span >
(In reply to Myeongsu Kim from <a href="show_bug.cgi?id=1213#c0">comment #0</a>)
<span class="quote">> I use Ubuntu 17.10 (nftables 0.8, kernel 4.13)
>
> NOTRACK is used to turn off connection tracking for all packets matching this
> rule. For example, in iptables:
>
> iptables -t raw -I PREROUTING -j NOTRACK
>
>
> I'd like to use stateless NAT (1:1)instead of iptables.</span >
You can already do stateless NAT (1:1), eg.
nft add rule x y ip saddr 192.168.204.60 ip daddr set 192.168.203.21
nat chains are only there for stateful nat, so you can just use a filter chain
instead.
<span class="quote">> nft add table NAT
> nft add chain NAT prerouting {type nat hook prerouting priority - 300 \; }
> nft add chain NAT postrouting {type nat hook postrouting priority - 300 \; }
> nft add rule NAT prerouting counter
> nft add rule NAT prerouting ip daddr 192.168.204.60 notrack counter
> nft add rule NAT prerouting counter
>
> The counter value of prerouting is zero.</span >
Right, this is a bug. We need a kernel fix for this: Basically, we need to
register conntrack if there's a NAT chain in place.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>