vyos-1x.git/data/templates/firewall/nftables-nat.tmpl, branch feature/T9082-codeql-cppVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp2022-05-01T18:08:28+00:00firewall: T4353: fix Jinja2 linting errors2022-05-01T18:08:28+00:00Christian Poessingerchristian@poessinger.com2022-05-01T18:08:28+00:00urn:sha1:9eab0cdd0bbea0f899af5a7d68cc63523a12a703nat: T4210: Fix template for negated ports2022-04-25T11:43:16+00:00Viacheslav Hletenkov.gletenko@vyos.io2022-04-25T11:43:16+00:00urn:sha1:825242cfd064d08f7980a577815adbfd251bb361NAT: T4365: Fix for nat tables manipulation on netfilter2022-04-18T18:31:12+00:00Nicolas Fortnicolasfort1988@gmail.com2022-04-18T18:31:12+00:00urn:sha1:bf8f30b5f87c62fa81f7fba4212493f0f2bc6375nat(66): T4333: migrate to new vyos_defined Jinja2 test2022-04-10T16:38:16+00:00Christian Poessingerchristian@poessinger.com2022-04-10T16:38:16+00:00urn:sha1:869c34b9c2c2a2bee142f7010be40419cce01433firewall: T2199: Migrate firewall to XML/Python2021-12-06T20:20:49+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2021-07-28T10:03:21+00:00urn:sha1:fdeba8da3e99256fe449e331d0b833a941315226nat: T1083: fix Jinja2 templating error2021-06-26T14:56:12+00:00Christian Poessingerchristian@poessinger.com2021-06-26T14:56:12+00:00urn:sha1:f98bad44fc9cd152955ef9e2bc54e811b8dd6cf5
Commit 166d44b3 ("nat: T1083: add translation options for persistent/random
mapping of address and port") added support for persistent IP address and port
mappings for NAT.
Unfortunately one if clause got lost in translation.
nat: T1083: add translation options for persistent/random mapping of address and port2021-06-26T07:48:54+00:00Igor Melnykigor_melnyk@ukr.net2021-06-26T07:48:54+00:00urn:sha1:166d44b32813c9dd64c3857beaf5eac8382b2d6d
Tested using:
set destination rule 100 inbound-interface 'eth0'
set destination rule 100 translation address '19.13.23.42'
set destination rule 100 translation options address-mapping 'random'
set destination rule 100 translation options port-mapping 'none'
set source rule 1000 outbound-interface 'eth0'
set source rule 1000 translation address '122.233.231.12'
set source rule 1000 translation options address-mapping 'persistent'
set source rule 1000 translation options port-mapping 'fully-random'nat: T3307: fix destination nat generation2021-02-12T21:42:47+00:00Esa Varemoesa@kuivanto.fi2021-02-12T21:42:47+00:00urn:sha1:4a0504a96cf0f3078e964ed201f196fb55172e00
Fix destination NAT template trying to map source->translation
instead of destination->translation.
Fixes https://phabricator.vyos.net/T3307
nptv6: T2518: Initial support for nat66 (NPT)2021-01-23T13:45:30+00:00jack9603301jack9603301@163.com2020-11-30T12:03:00+00:00urn:sha1:b047855b80754d78cab4d3161ad0e97c21f479bcnat: T2947: add many-many translation2021-01-19T20:04:28+00:00Christian Poessingerchristian@poessinger.com2021-01-19T20:01:20+00:00urn:sha1:9207897983a3bfafa0ec3e436c1ad67790f09f06
Support a 1:1 or 1:n prefix translation. The following configuration will NAT
source addresses from the 10.2.0.0/16 range to an address from 192.0.2.0/29.
For this feature to work a Linux Kernel 5.8 or higher is required!
vyos@vyos# show nat
source {
rule 100 {
outbound-interface eth1
source {
address 10.2.0.0/16
}
translation {
address 192.0.2.0/29
}
}
}
This results in the nftables configuration:
chain POSTROUTING {
type nat hook postrouting priority srcnat; policy accept;
oifname "eth1" counter packets 0 bytes 0 snat ip prefix to ip saddr map
{ 10.2.0.0/16 : 192.0.2.0/29 } comment "SRC-NAT-100"
}