From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Rob Hutton <justlikeef@gmail.com>
Cc: netfilter@vger.kernel.org
Subject: Re: dst NETMAP
Date: Tue, 23 May 2023 10:54:25 +0200 [thread overview]
Message-ID: <ZGx/QaErKi+JsoC1@calendula> (raw)
In-Reply-To: <CAGWgwrPXvZ-eVbsYp-zi0thV4=vz=nfj0jQ-_oEZo3e8TdOzeA@mail.gmail.com>
Hi,
On Mon, May 22, 2023 at 02:11:36PM -0400, Rob Hutton wrote:
> I am trying to set up a NAT gateway between two businesses where one
> initiates the connection outbound to the other, so therefore have dst
> nat entries in the following form:
>
> ip daddr 10.192.3.0/24 dnat ip to ip daddr map { 10.192.3.0/24 : 10.12.3.0/24 }
~~~~~~~~~~~~~~~~~~~~~~
No need for this redundant match, you can remove it. The map look
already provides the key matching side, therefore...
> and masquerade is enabled on the external interface.
>
> The netmap is translating the network portion correctly, but the host
> portion is not being preserved and is simply being chosen as if from a
> NAT pool. So pinging 10.192.3.254 should be translated to 10.12.3.254
> and instead it is translated to 10.12.3.64 (for example). How do I
> preserve the host portion during the NETMAP translation?
... this should be sufficient to achieve NETMAP in nftables:
dnat ip prefix to ip daddr map { 10.192.3.0/24 : 10.12.3.0/24 }
~~~~~~
note the 'prefix' keyword specifies that the address prefix needs to
be preserved, hence, achieving similar effect to iptables' NETMAP.
prev parent reply other threads:[~2023-05-23 8:54 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-22 18:11 dst NETMAP Rob Hutton
2023-05-23 8:54 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZGx/QaErKi+JsoC1@calendula \
--to=pablo@netfilter.org \
--cc=justlikeef@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).