From: Vigneswaran R <vignesh@atc.tcs.com>
To: Matteo Croce <technoboy85@gmail.com>
Cc: netfilter@vger.kernel.org
Subject: Re: nftables NAT
Date: Mon, 04 Aug 2014 09:54:02 +0530 [thread overview]
Message-ID: <53DF0AE2.5080202@atc.tcs.com> (raw)
In-Reply-To: <CAFnufp1kVrtPXm45VRYZK9G+oHBS0Uy9S_sfYzSmapSB5SdR0w@mail.gmail.com>
On 08/03/2014 04:05 PM, Matteo Croce wrote:
> Hi,
>
> I'm trying to setup a NAT on my router with nftables, my LAN is wlan0
> with address 192.168.20.1 and a the LAN is eth0 with address
> 192.168.1.7, ip forwarding is enabled:
>
> [~]# ifconfig eth0
> eth0 Link encap:Ethernet HWaddr 00:0d:b9:34:2b:e8
> inet addr:192.168.1.7 Bcast:192.168.1.255 Mask:255.255.255.0
> inet6 addr: fe80::20d:b9ff:fe34:2be8/64 Scope:Link
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:353 errors:0 dropped:0 overruns:0 frame:0
> TX packets:305 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:39409 (38.4 KiB) TX bytes:39077 (38.1 KiB)
>
> [~]# ifconfig wlan0
> wlan0 Link encap:Ethernet HWaddr 04:f0:21:0c:a3:7d
> inet addr:192.168.20.1 Bcast:192.168.20.255 Mask:255.255.255.0
> inet6 addr: fe80::6f0:21ff:fe0c:a37d/64 Scope:Link
> UP BROADCAST RUNNING MULTICAST MTU:1612 Metric:1
> RX packets:475 errors:0 dropped:0 overruns:0 frame:0
> TX packets:232 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:48202 (47.0 KiB) TX bytes:41345 (40.3 KiB)
>
> [~]# route -n
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref Use Iface
> 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
> 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
> 192.168.20.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0
> [~]# cat /proc/sys/net/ipv4/ip_forward
> 1
>
> I've setup nftables like this:
>
> [~]# nft -n list table nat
> table ip nat {
> chain postrouting {
> type nat hook postrouting priority 0;
> ip saddr 192.168.20.0/24 oif eth0 snat 192.168.1.7
> }
> }
>
> It correctly forwards the packet with the new address, but doesn't
> send the replies back:
>
> [~]# tcpdump -pni wlan0 icmp
> IP 192.168.20.23 > 8.8.8.8: ICMP echo request, id 9107, seq 11, length 64
> IP 192.168.20.23 > 8.8.8.8: ICMP echo request, id 9107, seq 12, length 64
> IP 192.168.20.23 > 8.8.8.8: ICMP echo request, id 9107, seq 13, length 64
> [~]# tcpdump -pni eth0 icmp
> IP 192.168.1.7 > 8.8.8.8: ICMP echo request, id 9107, seq 21, length 64
> IP 8.8.8.8 > 192.168.1.7: ICMP echo reply, id 9107, seq 21, length 64
> IP 192.168.1.7 > 8.8.8.8: ICMP echo request, id 9107, seq 22, length 64
> IP 8.8.8.8 > 192.168.1.7: ICMP echo reply, id 9107, seq 22, length 64
> IP 192.168.1.7 > 8.8.8.8: ICMP echo request, id 9107, seq 23, length 64
> IP 8.8.8.8 > 192.168.1.7: ICMP echo reply, id 9107, seq 23, length 64
>
> I can't see any problem in the configuration, any hint?
Just a thought.. Are you accepting packets in the FORWARD chain in both
directions (eth0 -> wlan0, wlan0 -> eth0)?
Vignesh
next prev parent reply other threads:[~2014-08-04 4:24 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-08-03 10:35 nftables NAT Matteo Croce
2014-08-04 4:24 ` Vigneswaran R [this message]
2014-08-04 8:46 ` Matteo Croce
2014-08-04 8:51 ` Arturo Borrero Gonzalez
2014-08-04 9:00 ` Matteo Croce
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=53DF0AE2.5080202@atc.tcs.com \
--to=vignesh@atc.tcs.com \
--cc=netfilter@vger.kernel.org \
--cc=technoboy85@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox