nftables 1.0.6: snat with maps

nftables 1.0.6: snat with maps

[Mucha Marcin, Sieciuch.com]

Hello,
I'm having trouble with moving from this snat rule:

chain source-nat {
        type nat hook postrouting priority 100; policy accept;
        ct state invalid drop;
        ip saddr 10.0.0.0/24 oif enp7s0 snat to 192.168.10.8 persistent;
        ip saddr 10.1.0.0/24 oif enp7s0 snat to 192.168.10.9 persistent;
        }
to the one that uses maps based on 
https://wiki.nftables.org/wiki-nftables/index.php/Multiple_NATs_using_nftables_maps 
:

chain source-nat {
         type nat hook postrouting priority 100; policy accept;
         ct state invalid drop;
         oif enp7s0 ip saddr maps {10.0.0.0/24 : 192.168.10.8, 
10.1.0.0/24 : 192.168.10.9};
}

My problem is - I'm getting syntax error after checking config with "nft 
-cf /etc/nftables.conf":
"/etc/nftables.conf:43:83-83: Error: syntax error, unexpected newline
     oif enp7s0 ip saddr maps {10.0.0.0/24 : 192.168.10.8, 10.1.0.0/24 : 
192.168.10.9};
                                                                          
             ^"
Could I ask you for a help?
System: Debian 12, Nftables 1.0.6
uname -a: 6.1.0-10-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.38-2 
(2023-07-27) x86_64 GNU/Linux


--
Thank you for your help!
Mucha Marcin

Re: nftables 1.0.6: snat with maps

[Eric]

On Wednesday, August 2nd, 2023 at 03:17, Mucha Marcin, Sieciuch.com <m.mucha@sieciuch.com> wrote:
> 
> chain source-nat {
> type nat hook postrouting priority 100; policy accept;
> ct state invalid drop;
> oif enp7s0 ip saddr maps {10.0.0.0/24 : 192.168.10.8, 10.1.0.0/24 : 192.168.10.9};
> }

I believe you are missing the "snat" operation in the second clause of the rule:

    oif enp7s0  snat ip saddr maps {10.0.0.0/24 : 192.168.10.8,
This guy ------ ^^^^


Eric

nftables 1.0.6: snat with maps

[Mucha Marcin, Sieciuch.com]

Hello,
I'm having trouble with moving from these snat rules:

chain source-nat {
        type nat hook postrouting priority 100; policy accept;
        ct state invalid drop;
        ip saddr 10.0.0.0/24 oif enp7s0 snat to 192.168.10.8 persistent;
        ip saddr 10.1.0.0/24 oif enp7s0 snat to 192.168.10.9 persistent;
        }
to the one that uses maps based on 
https://wiki.nftables.org/wiki-nftables/index.php/Multiple_NATs_using_nftables_maps 
:

chain source-nat {
         type nat hook postrouting priority 100; policy accept;
         ct state invalid drop;
         oif enp7s0 ip saddr maps {10.0.0.0/24 : 192.168.10.8, 
10.1.0.0/24 : 192.168.10.9};
}

My problem is - I'm getting syntax error after checking config with "nft 
-cf /etc/nftables.conf":
"/etc/nftables.conf:43:83-83: Error: syntax error, unexpected newline
     oif enp7s0 ip saddr maps {10.0.0.0/24 : 192.168.10.8, 10.1.0.0/24 : 
192.168.10.9};
                                                                          
             ^"
Could I ask you for a help?
System: Debian 12, Nftables 1.0.6
uname -a: 6.1.0-10-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.38-2 
(2023-07-27) x86_64 GNU/Linux


-
Thank you for your help!
Mucha Marcin

Re: nftables 1.0.6: snat with maps

[Florian Westphal]

Mucha Marcin, Sieciuch.com <m.mucha@sieciuch.com> wrote:
> Hello,
> I'm having trouble with moving from these snat rules:
> 
> chain source-nat {
>        type nat hook postrouting priority 100; policy accept;
>        ct state invalid drop;
>        ip saddr 10.0.0.0/24 oif enp7s0 snat to 192.168.10.8 persistent;
>        ip saddr 10.1.0.0/24 oif enp7s0 snat to 192.168.10.9 persistent;
>        }
> to the one that uses maps based on https://wiki.nftables.org/wiki-nftables/index.php/Multiple_NATs_using_nftables_maps
> :
> 
> chain source-nat {
>         type nat hook postrouting priority 100; policy accept;
>         ct state invalid drop;
>         oif enp7s0 ip saddr maps {10.0.0.0/24 : 192.168.10.8, 10.1.0.0/24 :
> 192.168.10.9};
> }
>
> My problem is - I'm getting syntax error after checking config with "nft -cf
> /etc/nftables.conf":
> "/etc/nftables.conf:43:83-83: Error: syntax error, unexpected newline
>     oif enp7s0 ip saddr maps {10.0.0.0/24 : 192.168.10.8, 10.1.0.0/24 :
> 192.168.10.9};
>            ^"
> Could I ask you for a help?

Did you mean
oif enp7s0 snat to ip saddr map {10.0.0.0/24 : 192.168.10.8, 10.1.0.0/24 : 192.168.10.9 }
?

Re: nftables 1.0.6: snat with maps

[Mucha Marcin (Sieciuch.com)]

W dniu 2023-08-02 13:10, Florian Westphal napisał(a):
> Mucha Marcin, Sieciuch.com <m.mucha@sieciuch.com> wrote:
>> Hello,
>> I'm having trouble with moving from these snat rules:
>> 
>> chain source-nat {
>>        type nat hook postrouting priority 100; policy accept;
>>        ct state invalid drop;
>>        ip saddr 10.0.0.0/24 oif enp7s0 snat to 192.168.10.8 
>> persistent;
>>        ip saddr 10.1.0.0/24 oif enp7s0 snat to 192.168.10.9 
>> persistent;
>>        }
>> to the one that uses maps based on 
>> https://wiki.nftables.org/wiki-nftables/index.php/Multiple_NATs_using_nftables_maps
>> :
>> 
>> chain source-nat {
>>         type nat hook postrouting priority 100; policy accept;
>>         ct state invalid drop;
>>         oif enp7s0 ip saddr maps {10.0.0.0/24 : 192.168.10.8, 
>> 10.1.0.0/24 :
>> 192.168.10.9};
>> }
>> 
>> My problem is - I'm getting syntax error after checking config with 
>> "nft -cf
>> /etc/nftables.conf":
>> "/etc/nftables.conf:43:83-83: Error: syntax error, unexpected newline
>>     oif enp7s0 ip saddr maps {10.0.0.0/24 : 192.168.10.8, 10.1.0.0/24 
>> :
>> 192.168.10.9};
>>            ^"
>> Could I ask you for a help?
> 
> Did you mean
> oif enp7s0 snat to ip saddr map {10.0.0.0/24 : 192.168.10.8, 
> 10.1.0.0/24 : 192.168.10.9 }
> ?

Thank you, now I understand my mistake.