Re: Masquerading with selectively open ports -- nftables

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Oct 29, 2015 at 09:11:03AM +0100, Arturo Borrero Gonzalez wrote:
> On 29 October 2015 at 05:51, Johannes Ernst <johannes.ernst@gmail.com> wrote:
> >> On Oct 28, 2015, at 16:15, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
[...]
> >> Moreover, make sure you also compiled masquerading support for nf_tables:
> >>
> >> CONFIG_NFT_MASQ=m
> >
> > Ahh, that might be it. The Arch build script is here [2] and I
> > don’t see anything that looks like CONFIG_NFT_MASQ. I’ll recompile
> > tomorrow and see where that leads us.
> >
> 
> this config option is from the linux kernel, for example:
> 
> % grep CONFIG_NFT_ /boot/config-4.2.0-1-amd64
> CONFIG_NFT_EXTHDR=m
> CONFIG_NFT_META=m
> CONFIG_NFT_CT=m
> CONFIG_NFT_RBTREE=m
> CONFIG_NFT_HASH=m
> CONFIG_NFT_COUNTER=m
> CONFIG_NFT_LOG=m
> CONFIG_NFT_LIMIT=m
> CONFIG_NFT_MASQ=m
> CONFIG_NFT_REDIR=m
> CONFIG_NFT_NAT=m
> CONFIG_NFT_QUEUE=m
> CONFIG_NFT_REJECT=m
> CONFIG_NFT_REJECT_INET=m
> CONFIG_NFT_COMPAT=m
> CONFIG_NFT_CHAIN_ROUTE_IPV4=m
> CONFIG_NFT_REJECT_IPV4=m
> CONFIG_NFT_CHAIN_NAT_IPV4=m
> CONFIG_NFT_MASQ_IPV4=m
> # CONFIG_NFT_REDIR_IPV4 is not set
> CONFIG_NFT_CHAIN_ROUTE_IPV6=m
> CONFIG_NFT_REJECT_IPV6=m
> CONFIG_NFT_CHAIN_NAT_IPV6=m
> CONFIG_NFT_MASQ_IPV6=m
> # CONFIG_NFT_REDIR_IPV6 is not set
> CONFIG_NFT_BRIDGE_META=m
> CONFIG_NFT_BRIDGE_REJECT=m

It would be good to have a sort of "compiling nf_tables kernel
support" on the wiki, in case anyone finds the time to contribute it.
We can use what Eric Leblond wrote time ago on his quick howto and
update it.

[...]
> In nftables tables has no special semantic apart of storing chains.
> Beware of families however, I doubt the inet family can hold NAT
> stuff.

I confirm this: We have no nat table for inet, only filter.