About nftable nat rule

About nftable nat rule

[Zheng konia]

Hi,

   I am tranferring Iptables-nat to nftables-nat for testing the nat
forwarding efficiency. However, I have some doubles, hope you can help
me.


  nft add rule nat prerouting tcp dport 80  dnat  192.168.1.100:4040
  nft add rule nat prerouting tcp dport 80  dnat  192.168.1.100:4050
  nft add rule nat prerouting tcp dport 80  dnat  192.168.1.100:4060
  nft add rule nat prerouting tcp dport 80  dnat  192.168.1.100:4070
  ...

  How can I put these rules in one to get load balacne? I have tried
bellow, not work.

 nft add rule nat prerouting tcp dport 80  dnat  192.168.1.100 :
{4040, 4050, 4060, 4070}  persistent

 or using jhash


 nft add rule nat prerouting tcp dport 80  dnat  192.168.1.100 :
jhash ip saddr . tcp dport mod 4 map {0 : 4040, 1 : 4050, 2 : 4060, 3
: 4070}


 Can you show me how to do that? Thanks.



Konia Zheng
2017.05.24

Re: About nftable nat rule

[Arturo Borrero Gonzalez]

On 24 May 2017 at 10:40, Zheng konia <konianet@gmail.com> wrote:
>
>  Can you show me how to do that? Thanks.
>

Please read the docs:

https://wiki.nftables.org/wiki-nftables/index.php/Load_balancing
https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)
https://wiki.nftables.org/wiki-nftables/index.php/Multiple_NATs_using_nftables_maps

Re: About nftable nat rule

[Zheng konia]

Hi, I do have read your wiki.

However, there's less example about DNAT --to-destination-port range.
You do have examples about to different destination, while I am
looking for the different destination-port balance.

Any suggestion?

2017-05-24 17:07 GMT+08:00 Arturo Borrero Gonzalez <arturo@debian.org>:
> On 24 May 2017 at 10:40, Zheng konia <konianet@gmail.com> wrote:
>>
>>  Can you show me how to do that? Thanks.
>>
>
> Please read the docs:
>
> https://wiki.nftables.org/wiki-nftables/index.php/Load_balancing
> https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)
> https://wiki.nftables.org/wiki-nftables/index.php/Multiple_NATs_using_nftables_maps

Re: About nftable nat rule

[Arturo Borrero Gonzalez]

On 24 May 2017 at 11:30, Zheng konia <konianet@gmail.com> wrote:
> Hi, I do have read your wiki.
>
> However, there's less example about DNAT --to-destination-port range.
> You do have examples about to different destination, while I am
> looking for the different destination-port balance.
>
> Any suggestion?
>

Try something like this:

nft add rule t c ip protocol tcp dnat to 192.168.1.100 : numgen inc
mod 2 map { 0 : 4040 , 1 : 4050 }
(i.e, the destination address doesn't change, but port does)


We can update the wiki if that works.

Re: About nftable nat rule

[Pablo Neira Ayuso]

On Wed, May 24, 2017 at 11:49:04AM +0200, Arturo Borrero Gonzalez wrote:
> On 24 May 2017 at 11:30, Zheng konia <konianet@gmail.com> wrote:
> > Hi, I do have read your wiki.
> >
> > However, there's less example about DNAT --to-destination-port range.
> > You do have examples about to different destination, while I am
> > looking for the different destination-port balance.
> >
> > Any suggestion?
> >
> 
> Try something like this:
> 
> nft add rule t c ip protocol tcp dnat to 192.168.1.100 : numgen inc
> mod 2 map { 0 : 4040 , 1 : 4050 }
> (i.e, the destination address doesn't change, but port does)
> 
> We can update the wiki if that works.

BTW, depending on your environment, you may want to use a stateless
NAT approach too that should be faster, eg.

nft add rule t c ip protocol ip daddr set 192.168.1.100 \
        tcp dport set numgen inc mod 2 map { 0 : 4040 , 1 : 4050 }

This requires a recent Linux kernel though.

Note: Beware with stateless NAT, it only works with 1:1 mappings, it's
easy to shoot yourself on your own feet... Otherwise, stick to the
stateful approach.

Re: About nftable nat rule

[Arturo Borrero Gonzalez]

On 24 May 2017 at 12:44, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Note: Beware with stateless NAT, it only works with 1:1 mappings, it's
> easy to shoot yourself on your own feet... Otherwise, stick to the
> stateful approach.

Just updated the wiki to add this information:

https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)#Stateless_NAT
https://wiki.nftables.org/wiki-nftables/index.php/Load_balancing