[Bug 1213] Nft stateless NAT (NOTRACK)

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1213

Pablo Neira Ayuso <pablo at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |fw at strlen.de,
                   |                            |pablo at netfilter.org

--- Comment #1 from Pablo Neira Ayuso <pablo at netfilter.org> ---
(In reply to Myeongsu Kim from comment #0)
> I use Ubuntu 17.10 (nftables 0.8, kernel 4.13)
> 
> NOTRACK is used to turn off connection tracking for all packets matching this
> rule. For example, in iptables:
> 
> iptables -t raw -I PREROUTING -j NOTRACK
> 
> 
> I'd like to use stateless NAT (1:1)instead of iptables.
> 
> nft add table NAT
> nft add chain NAT prerouting {type nat hook prerouting priority - 300 \; }
> nft add chain NAT postrouting {type nat hook postrouting priority - 300 \; }
> nft add rule NAT prerouting counter
> nft add rule NAT prerouting ip daddr 192.168.204.60 notrack counter
> nft add rule NAT prerouting counter
> 
> The counter value of prerouting is zero.
> 
> table ip NAT{
>      chain prerouting {
>           counter packets 0 bytes 0
>           ip daddr 192.168.204.60 notrack counter packets 0 bytes 0
>           counter packets 0 bytes 0
>      }
> 
> Thanks,

(In reply to Myeongsu Kim from comment #0)
> I use Ubuntu 17.10 (nftables 0.8, kernel 4.13)
> 
> NOTRACK is used to turn off connection tracking for all packets matching this
> rule. For example, in iptables:
> 
> iptables -t raw -I PREROUTING -j NOTRACK
> 
> 
> I'd like to use stateless NAT (1:1)instead of iptables.

You can already do stateless NAT (1:1), eg.

nft add rule x y ip saddr 192.168.204.60 ip daddr set 192.168.203.21

nat chains are only there for stateful nat, so you can just use a filter chain
instead.

> nft add table NAT
> nft add chain NAT prerouting {type nat hook prerouting priority - 300 \; }
> nft add chain NAT postrouting {type nat hook postrouting priority - 300 \; }
> nft add rule NAT prerouting counter
> nft add rule NAT prerouting ip daddr 192.168.204.60 notrack counter
> nft add rule NAT prerouting counter
> 
> The counter value of prerouting is zero.

Right, this is a bug. We need a kernel fix for this: Basically, we need to
register conntrack if there's a NAT chain in place.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20180202/85e6f1d5/attachment.html>