diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-17 21:52:30 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-10-17 21:52:30 +0200 |
| commit | 385cafdcbb10e90c04462bc8e17fcf89e483382a (patch) | |
| tree | 5fa1c1e6f5ff3594daf69882c3a21b0857589581 /python | |
| parent | db29bdc899e4b4c27569d3c5705839b924393fe6 (diff) | |
| download | vyos-1x-385cafdcbb10e90c04462bc8e17fcf89e483382a.tar.gz vyos-1x-385cafdcbb10e90c04462bc8e17fcf89e483382a.zip | |
nat: T9475: keep translation port when translating to a prefix
A translation prefix combined with a port range lost the port range when
the rule had no matching source or destination address - the rule only
said "snat prefix to <prefix>" and gave no warning.
nft has no syntax for a prefix plus port range, so such rules now use the
same map form as rules with an address, keyed on 0.0.0.0/0. This keeps the
1:1 prefix mapping and adds the port range.
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/nat.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/python/vyos/nat.py b/python/vyos/nat.py index 0a252bbd8..1fdbc2037 100644 --- a/python/vyos/nat.py +++ b/python/vyos/nat.py @@ -92,6 +92,10 @@ def parse_nat_rule(rule_conf, rule_id, nat_type, ipv6=False): else: translation_output.append(f'{ip_prefix} prefix to {ip_prefix} {translation_prefix}addr map {{ {map_addr} : {addr} }}') ignore_type_addr = True + elif port: + # nft has no "prefix to <net>:<port>" syntax, a catch-all + # map key keeps the 1:1 prefix mapping plus the port range + translation_output.append(f'{ip_prefix} prefix to {ip_prefix} {translation_prefix}addr map {{ 0.0.0.0/0 : {addr} . {port} }}') else: translation_output.append(f'prefix to {addr}') else: |