nat: T2947: add many-many translation

Support a 1:1 or 1:n prefix translation. The following configuration will NAT
source addresses from the 10.2.0.0/16 range to an address from 192.0.2.0/29.

For this feature to work a Linux Kernel 5.8 or higher is required!

vyos@vyos# show nat
 source {
     rule 100 {
         outbound-interface eth1
         source {
             address 10.2.0.0/16
         }
         translation {
             address 192.0.2.0/29
         }
     }
 }

This results in the nftables configuration:

chain POSTROUTING {
    type nat hook postrouting priority srcnat; policy accept;
    oifname "eth1" counter packets 0 bytes 0 snat ip prefix to ip saddr map
        { 10.2.0.0/16 : 192.0.2.0/29 } comment "SRC-NAT-100"
}

1 files changed, 23 insertions, 8 deletions

diff --git a/data/templates/firewall/nftables-nat.tmpl b/data/templates/firewall/nftables-nat.tmpl
index 770a24a95..5480447f2 100644
--- a/data/templates/firewall/nftables-nat.tmpl
+++ b/data/templates/firewall/nftables-nat.tmpl
@@ -21,18 +21,34 @@
 {%     set comment   = 'DST-NAT-' + rule %}
 {%     set base_log  = '[NAT-DST-' + rule %}
 {%     set interface = ' iifname "' + config.inbound_interface + '"' if config.inbound_interface is defined and config.inbound_interface != 'any' else '' %}
-{%     set trns_addr = 'dnat to ' + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %}
+{%     if config.translation is defined and config.translation.address is defined and config.translation.address is not none %}
+{#       support 1:1 network translation #}
+{%       if config.translation.address | is_ip_network %}
+{%         set trns_addr = 'dnat ip prefix to ip daddr map { ' + config.source.address + ' : ' + config.translation.address + ' }' %}
+{#         we can now clear out the src_addr part as it's already covered in aboves map #}
+{%         set src_addr  = '' %}
+{%       else %}
+{%         set trns_addr = 'dnat to ' + config.translation.address %}
+{%       endif %}
+{%     endif %}
 {%   elif chain == 'POSTROUTING' %}
 {%     set comment   = 'SRC-NAT-' + rule %}
 {%     set base_log  = '[NAT-SRC-' + rule %}
 {%     set interface = ' oifname "' + config.outbound_interface + '"' if config.outbound_interface is defined and config.outbound_interface != 'any' else '' %}
-{%     if config.translation is defined and config.translation.address is defined and config.translation.address == 'masquerade' %}
-{%       set trns_addr = config.translation.address %}
-{%       if config.translation.port is defined and config.translation.port is not none %}
-{%         set trns_addr = trns_addr + ' to ' %}
+{%     if config.translation is defined and config.translation.address is defined and config.translation.address is not none %}
+{%       if config.translation.address == 'masquerade' %}
+{%         set trns_addr = config.translation.address %}
+{%         if config.translation.port is defined and config.translation.port is not none %}
+{%           set trns_addr = trns_addr + ' to ' %}
+{%         endif %}
+{#       support 1:1 network translation #}
+{%       elif config.translation.address | is_ip_network %}
+{%         set trns_addr = 'snat ip prefix to ip saddr map { ' + config.source.address + ' : ' + config.translation.address + ' }' %}
+{#         we can now clear out the src_addr part as it's already covered in aboves map #}
+{%         set src_addr  = '' %}
+{%       else %}
+{%         set trns_addr = 'snat to ' + config.translation.address %}
 {%       endif %}
-{%     else %}
-{%       set trns_addr = 'snat to ' + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %}
 {%     endif %}
 {%   endif %}
 {%   set trns_port = ':' + config.translation.port if config.translation is defined and config.translation.port is defined and config.translation.port is not none %}
@@ -132,7 +148,6 @@ add rule ip raw NAT_CONNTRACK counter accept
 {{ nat_rule(rule, config, 'PREROUTING') }}
 {%   endfor %}
 {% endif %}
-
 #
 # Source NAT rules build up here
 #