Traffic NAT

This chapter covers some aspects related to NAT (Network Address Translation), which is a set of rules that rewrites the source or destination address of the packets traversing an interface. NAT is configured per interface, under traffic nat.

Two types of translation are supported:

  • source (SNAT): rewrites the source address of outgoing packets. For example, to let hosts on a private network reach an external network using the address of the outgoing interface.

  • destination (DNAT): rewrites the destination address of incoming packets. For example, to expose an internal service or to forward a port to a host placed behind the device.

Each direction contains a set of rules that are processed in ascending order. The first rule that matches a packet applies its translation, and the remaining rules are not evaluated.

Note

A rule can optionally use a traffic selector to choose which packets it applies to. If no selector is configured, the rule matches all packets.

Here you can find more information about traffic selectors.

Configuration

This is the syntax to assign a source NAT rule to an interface:

set interfaces <if_type> <if_name> traffic nat source rule <u32> [ ... ]

And this is the syntax to assign a destination NAT rule to an interface:

set interfaces <if_type> <if_name> traffic nat destination rule <u32> [ ... ]

Each rule defines how the matched packets are translated. The following options are available:

  • address: target of the translation. It accepts a single IPv4 address, a network, an address range (pool) or a special keyword. For source NAT the keyword is masquerade (use the address of the outgoing interface). For destination NAT it is redirect (use the address of the incoming interface).

  • network: translate using a network prefix. The host part of the address is kept and only the network part is rewritten. /32 prefixes are not allowed; use address instead.

  • port: port (or port range) used in the translation (PAT). It requires protocol to be set.

  • protocol: transport protocol the rule applies to (tcp, udp, sctp or dccp).

  • selector: traffic selector used to match packets.

  • log: log the packets to which the rule has been applied.

  • description: free-text description of the rule.

Each rule is validated independently. Within a single rule:

  • at least one of address, network or port must be set.

  • address and network cannot be used together.

  • network cannot be combined with port.

  • port requires protocol.

Note

The traffic seen by NAT can be affected by traffic policies executed before it. Policies configured with very-high or high priority are applied before NAT, so they may modify or drop packets before the NAT rules are evaluated.

Here you can find more information about traffic policies.

Examples

Let’s suppose hosts on the LAN side (eth0) must reach the WAN side (eth1) using the address of the outgoing interface. We can configure a source NAT rule with masquerade:

set interfaces ethernet eth1 traffic nat source rule 1 address masquerade

Now, let’s suppose incoming TCP traffic destined to port 80 on eth1 must be forwarded to an internal server at 192.168.100.2 on port 8080. We can configure a destination NAT rule:

set traffic selector SEL rule 1 protocol tcp
set traffic selector SEL rule 1 destination port 80
set interfaces ethernet eth1 traffic nat destination rule 1 selector SEL
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.100.2
set interfaces ethernet eth1 traffic nat destination rule 1 protocol tcp
set interfaces ethernet eth1 traffic nat destination rule 1 port 8080

Take a look at the following entries to see more information about NAT:

Monitoring

The traffic nat show operational command can be used to display the NAT rules applied on each interface together with their counters (the number of packets and bytes that matched each rule). The output can be restricted to a single interface with traffic nat show <ifc>, expanded with the detailed modifier or printed in JSON format with the json modifier.

In the following example, a host on the internal network 192.168.100.0/24 pings an external server (10.0.0.28). The outgoing packets are translated with source NAT (masquerade), so their source address becomes the external address 10.0.0.2:

Example:

admin@osdx$ traffic nat show

-------------------------------------------------------------
iface   mode   pkts match  pkts eval  bytes match  bytes eval
-------------------------------------------------------------
eth1   source           1          1           84          84
-------------------------------------------------------------
Total                   1          1           84          84

Nat eth1 source

---------------------------------------------------------------
rule   selector  pkts match  pkts eval  bytes match  bytes eval
---------------------------------------------------------------
1      -                  1          1           84          84
---------------------------------------------------------------
Total                     1          1           84          84

Note

The NAT rule counter only accounts for the first packet of each connection. The remaining packets are translated directly from the connection tracking table, without traversing the NAT rules again.

In addition, active translations can be inspected through connection tracking with the system conntrack show command, which displays the original and the translated addresses of each connection.

Example:

admin@osdx$ system conntrack show nat
icmp     1 27 src=192.168.100.2 dst=10.0.0.28 type=8 code=0 id=21 packets=19 bytes=1596 src=10.0.0.28 dst=10.0.0.2 type=0 code=0 id=21 packets=19 bytes=1596 mark=0 use=1
conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.

Command Summary

Configuration commands

Operational commands