nat64: T8456: add constraint for translation port range

NAT64 requires dedicated transport address space for translation, similar to
exclusive port ownership during socket binding. If a local process and Jool
translation both use the same transport tuple (for example, 192.0.2.1:5000),
traffic conflicts can occur.

Jool does not prevent pool4 from overlapping with other port allocations, so
avoiding conflicts is an operator responsibility.

In addition to service ports already in use, account for Linux ephemeral
range (net.ipv4.ip_local_port_range), which defaults to 32768-60999. This
default is why, when pool4 is empty, Jool uses 61001-65535 on the node's
primary global addresses.

One can adjust the ephemeral range via sysctl, and Jools translation range via
pool4 add/remove.

vyos@vyos:~$ sysctl net.ipv4.ip_local_port_range
net.ipv4.ip_local_port_range = 32768	60999

VyOS now uses verify() in NAT64 to check that the supplied tranlation port
range does not overlap with the Kernels ephemeral port range.

0 files changed, 0 insertions, 0 deletions