<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:tad1073@gmail.com" title="Thomas <tad1073@gmail.com>"> <span class="fn">Thomas</span></a>
</span> changed
<a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - nftables SNAT is not working"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1255">bug 1255</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>tad1073@gmail.com
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - nftables SNAT is not working"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1255#c3">Comment # 3</a>
on <a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - nftables SNAT is not working"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1255">bug 1255</a>
from <span class="vcard"><a class="email" href="mailto:tad1073@gmail.com" title="Thomas <tad1073@gmail.com>"> <span class="fn">Thomas</span></a>
</span></b>
<pre>(In reply to Andrey Belkin from <a href="show_bug.cgi?id=1255#c0">comment #0</a>)
<span class="quote">> Set-up:
>
> 1. Linux (tried on LEDE@arm, OpenWrt@arm, Ubuntu16@x86)
> 2. iptables disabled (kernel modules unloaded)
> 3. nftables (tried v. 0.8, 0.8.2)
> 4. chains and NAT are created according to official nftables wiki
> <a href="https://wiki.nftables.org/wiki-nftables/index.php/">https://wiki.nftables.org/wiki-nftables/index.php/</a>
> Performing_Network_Address_Translation_(NAT):
>
> % nft add table nat
> % nft add chain nat prerouting { type nat hook prerouting priority 0 \; }
> % nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
>
> By this set-up, dnat functions as expected, e.g.:
>
> % nft add rule nat prerouting tcp dport 15000 dnat 192.168.0.50:20000
>
> redirects all incoming TCP packets from port 15000 to 192.168.0.50:20000 and
> back.
>
>
> However, no snat rule is processed (neither rule of):
>
> % nft add rule nat postrouting counter ip saddr 192.168.0.50 snat 1.2.3.4
> % nft add rule nat postrouting counter tcp sport 20000 snat 1.2.3.4:1234
> % nft add rule nat postrouting counter ip protocol tcp drop
>
> I've tried these rules separately or in variations (oif, ip+tcp, ...) - the
> packets are still going through unchanged (proved by WireShark) or not
> dropped. Though:
>
> 1. The postrouting chain is processed, since if I remove postrouting chain,
> dnat (by prerouting) stops to work (as expected).
> 2. Adding a drop rule to input or output chains works.
>
> Any ideas here?</span >
If you're copy and pasting that might be the problem.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>