From 385cafdcbb10e90c04462bc8e17fcf89e483382a Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 17 Oct 2026 21:52:30 +0200 Subject: nat: T9475: keep translation port when translating to a prefix A translation prefix combined with a port range lost the port range when the rule had no matching source or destination address - the rule only said "snat prefix to " and gave no warning. nft has no syntax for a prefix plus port range, so such rules now use the same map form as rules with an address, keyed on 0.0.0.0/0. This keeps the 1:1 prefix mapping and adds the port range. --- python/vyos/nat.py | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'python') diff --git a/python/vyos/nat.py b/python/vyos/nat.py index 0a252bbd8..1fdbc2037 100644 --- a/python/vyos/nat.py +++ b/python/vyos/nat.py @@ -92,6 +92,10 @@ def parse_nat_rule(rule_conf, rule_id, nat_type, ipv6=False): else: translation_output.append(f'{ip_prefix} prefix to {ip_prefix} {translation_prefix}addr map {{ {map_addr} : {addr} }}') ignore_type_addr = True + elif port: + # nft has no "prefix to :" syntax, a catch-all + # map key keeps the 1:1 prefix mapping plus the port range + translation_output.append(f'{ip_prefix} prefix to {ip_prefix} {translation_prefix}addr map {{ 0.0.0.0/0 : {addr} . {port} }}') else: translation_output.append(f'prefix to {addr}') else: -- cgit v1.2.3