================================= Traffic NAT ================================= .. sidebar:: Contents .. contents:: :depth: 2 :local: This chapter covers some aspects related to ``NAT`` (Network Address Translation), which is a set of rules that rewrites the source or destination address of the packets traversing an interface. NAT is configured per interface, under ``traffic nat``. Two types of translation are supported: * **source** (SNAT): rewrites the source address of outgoing packets. For example, to let hosts on a private network reach an external network using the address of the outgoing interface. * **destination** (DNAT): rewrites the destination address of incoming packets. For example, to expose an internal service or to forward a port to a host placed behind the device. Each direction contains a set of rules that are processed in ascending order. The first rule that matches a packet applies its translation, and the remaining rules are not evaluated. .. note:: A rule can optionally use a ``traffic selector`` to choose which packets it applies to. If no selector is configured, the rule matches all packets. :doc:`Here <../selector/index>` you can find more information about ``traffic selectors``. Configuration ============= This is the syntax to assign a ``source NAT`` rule to an interface: .. code-block:: none set interfaces traffic nat source rule [ ... ] And this is the syntax to assign a ``destination NAT`` rule to an interface: .. code-block:: none set interfaces traffic nat destination rule [ ... ] Each rule defines how the matched packets are translated. The following options are available: * **address**: target of the translation. It accepts a single IPv4 address, a network, an address range (pool) or a special keyword. For source NAT the keyword is ``masquerade`` (use the address of the outgoing interface). For destination NAT it is ``redirect`` (use the address of the incoming interface). * **network**: translate using a network prefix. The host part of the address is kept and only the network part is rewritten. ``/32`` prefixes are not allowed; use ``address`` instead. * **port**: port (or port range) used in the translation (PAT). It requires ``protocol`` to be set. * **protocol**: transport protocol the rule applies to (``tcp``, ``udp``, ``sctp`` or ``dccp``). * **selector**: ``traffic selector`` used to match packets. * **log**: log the packets to which the rule has been applied. * **description**: free-text description of the rule. Each rule is validated independently. Within a single rule: * at least one of ``address``, ``network`` or ``port`` must be set. * ``address`` and ``network`` cannot be used together. * ``network`` cannot be combined with ``port``. * ``port`` requires ``protocol``. .. note:: The traffic seen by NAT can be affected by ``traffic policies`` executed before it. Policies configured with ``very-high`` or ``high`` priority are applied before NAT, so they may modify or drop packets before the NAT rules are evaluated. :doc:`Here <../policy/index>` you can find more information about ``traffic policies``. Examples ======== Let's suppose hosts on the LAN side (``eth0``) must reach the WAN side (``eth1``) using the address of the outgoing interface. We can configure a source NAT rule with ``masquerade``: .. code-block:: none set interfaces ethernet eth1 traffic nat source rule 1 address masquerade Now, let's suppose incoming TCP traffic destined to port ``80`` on ``eth1`` must be forwarded to an internal server at ``192.168.100.2`` on port ``8080``. We can configure a destination NAT rule: .. code-block:: none set traffic selector SEL rule 1 protocol tcp set traffic selector SEL rule 1 destination port 80 set interfaces ethernet eth1 traffic nat destination rule 1 selector SEL set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.100.2 set interfaces ethernet eth1 traffic nat destination rule 1 protocol tcp set interfaces ethernet eth1 traffic nat destination rule 1 port 8080 Take a look at the following entries to see more information about ``NAT``: * :ref:`example_interfaces_ethernet_traffic_nat_snat`. * :ref:`example_interfaces_ethernet_traffic_nat_dnat`. Monitoring ========== The :osdx:op:`traffic nat show` operational command can be used to display the NAT rules applied on each interface together with their counters (the number of packets and bytes that matched each rule). The output can be restricted to a single interface with :osdx:op:`traffic nat show *`, expanded with the ``detailed`` modifier or printed in JSON format with the ``json`` modifier. In the following example, a host on the internal network ``192.168.100.0/24`` pings an external server (``10.0.0.28``). The outgoing packets are translated with ``source NAT`` (``masquerade``), so their source address becomes the external address ``10.0.0.2``: *Example:* .. code-block:: none admin@osdx$ traffic nat show ------------------------------------------------------------- iface mode pkts match pkts eval bytes match bytes eval ------------------------------------------------------------- eth1 source 1 1 84 84 ------------------------------------------------------------- Total 1 1 84 84 Nat eth1 source --------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------- 1 - 1 1 84 84 --------------------------------------------------------------- Total 1 1 84 84 .. note:: The NAT rule counter only accounts for the first packet of each connection. The remaining packets are translated directly from the connection tracking table, without traversing the NAT rules again. In addition, active translations can be inspected through connection tracking with the :osdx:op:`system conntrack show` command, which displays the original and the translated addresses of each connection. *Example:* .. code-block:: none admin@osdx$ system conntrack show nat icmp 1 27 src=192.168.100.2 dst=10.0.0.28 type=8 code=0 id=21 packets=19 bytes=1596 src=10.0.0.28 dst=10.0.0.2 type=0 code=0 id=21 packets=19 bytes=1596 mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown. Command Summary =============== .. osdx:cmdtree:: cfg :maxdepth: 5 interfaces ethernet * traffic nat .. osdx:cmdtree:: op traffic nat