Re: What wrong with snat in nftables?

[sorcus@inwebse.com]

Output for command nft --debug all -f ruleset

https://gist.github.com/MrSorcus/2c8c65461e3c65fb70364f3a70d95439


On 2017-07-14 01:06, sorcus@inwebse.com wrote:
> Nftables rules for server -
> https://gist.github.com/MrSorcus/17827298ad81970cc272b9e7f779923f
> 
> Nftables rules for client -
> https://gist.github.com/MrSorcus/ad05f19759e02f92aac5d9c246f56cf6
> 
> I used information from here -
> https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)
> 
>> 1. flush conntrack entries after changing of rules in the nat table.
> 
> "conntrack -D" - show me "0 flow entries have been deleted.". But
> "/proc/net/nf_conntrack" has 3 entries...
> 
>> 2. add counters to nftables nat rule to check that rule really hit the 
>> packets.
> 
> chain postrouting {
>   type nat hook postrouting priority 0; policy drop;
>   oif "enp0s3" nftrace set 1 counter packets 3 bytes 312 snat to
> 2a01:4f8:xx:xx::10
>   nftrace set 1 counter packets 0 bytes 0 accept comment "IPv6 < Nat <
> Postrouting"
> }
> 
> With git version of nftables, libmnl & libnftnl and kernels 4.9, 4.11
> & 4.12 doesn't work...
> With archlinux server doesn't work too...