summaryrefslogtreecommitdiff
path: root/docs/configuration/nat
diff options
context:
space:
mode:
Diffstat (limited to 'docs/configuration/nat')
-rw-r--r--docs/configuration/nat/index.rst1
-rw-r--r--docs/configuration/nat/nat44.rst176
-rw-r--r--docs/configuration/nat/nat64.rst81
-rw-r--r--docs/configuration/nat/nat66.rst8
4 files changed, 219 insertions, 47 deletions
diff --git a/docs/configuration/nat/index.rst b/docs/configuration/nat/index.rst
index 90275226..6556b7f9 100644
--- a/docs/configuration/nat/index.rst
+++ b/docs/configuration/nat/index.rst
@@ -9,4 +9,5 @@ NAT
:includehidden:
nat44
+ nat64
nat66
diff --git a/docs/configuration/nat/nat44.rst b/docs/configuration/nat/nat44.rst
index b2ba61af..98b230a9 100644
--- a/docs/configuration/nat/nat44.rst
+++ b/docs/configuration/nat/nat44.rst
@@ -148,23 +148,35 @@ rule.
* **outbound-interface** - applicable only to :ref:`source-nat`. It
configures the interface which is used for the outside traffic that
- this translation rule applies to.
+ this translation rule applies to. Interface groups, inverted
+ selection and wildcard, are also supported.
- Example:
+ Examples:
.. code-block:: none
- set nat source rule 20 outbound-interface eth0
+ set nat source rule 20 outbound-interface name eth0
+ set nat source rule 30 outbound-interface name bond1*
+ set nat source rule 20 outbound-interface name !vtun2
+ set nat source rule 20 outbound-interface group GROUP1
+ set nat source rule 20 outbound-interface group !GROUP2
+
* **inbound-interface** - applicable only to :ref:`destination-nat`. It
configures the interface which is used for the inside traffic the
- translation rule applies to.
+ translation rule applies to. Interface groups, inverted
+ selection and wildcard, are also supported.
Example:
.. code-block:: none
- set nat destination rule 20 inbound-interface eth1
+ set nat destination rule 20 inbound-interface name eth0
+ set nat destination rule 30 inbound-interface name bond1*
+ set nat destination rule 20 inbound-interface name !vtun2
+ set nat destination rule 20 inbound-interface group GROUP1
+ set nat destination rule 20 inbound-interface group !GROUP2
+
* **protocol** - specify which types of protocols this translation rule
applies to. Only packets matching the specified protocol are NATed.
@@ -273,6 +285,42 @@ Example:
set nat destination rule 10 translation address 192.0.2.10
+Also, in :ref:`destination-nat`, redirection to localhost is supported.
+The redirect statement is a special form of dnat which always translates
+the destination address to the local host’s one.
+
+Example of redirection:
+
+.. code-block:: none
+
+ set nat destination rule 10 translation redirect port 22
+
+NAT Load Balance
+----------------
+
+Advanced configuration can be used in order to apply source or destination NAT,
+and within a single rule, be able to define multiple translated addresses,
+so NAT balances the translations among them.
+
+NAT Load Balance uses an algorithm that generates a hash and based on it, then
+it applies corresponding translation. This hash can be generated randomly, or
+can use data from the ip header: source-address, destination-address,
+source-port and/or destination-port. By default, it will generate the hash
+randomly.
+
+When defining the translated address, called ``backends``, a ``weight`` must
+be configured. This lets the user define load balance distribution according
+to their needs. Them sum of all the weights defined for the backends should
+be equal to 100. In oder words, the weight defined for the backend is the
+percentage of the connections that will receive such backend.
+
+.. cfgcmd:: set nat [source | destination] rule <rule> load-balance hash
+ [source-address | destination-address | source-port | destination-port
+ | random]
+.. cfgcmd:: set nat [source | destination] rule <rule> load-balance backend
+ <x.x.x.x> weight <1-100>
+
+
Configuration Examples
======================
@@ -287,7 +335,7 @@ demonstrate the following configuration:
.. code-block:: none
- set nat source rule 100 outbound-interface 'eth0'
+ set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.0.0/24'
set nat source rule 100 translation address 'masquerade'
@@ -296,7 +344,9 @@ Which generates the following configuration:
.. code-block:: none
rule 100 {
- outbound-interface eth0
+ outbound-interface {
+ name eth0
+ }
source {
address 192.168.0.0/24
}
@@ -388,19 +438,19 @@ Example:
set nat destination rule 100 description 'Regular destination NAT from external'
set nat destination rule 100 destination port '3389'
- set nat destination rule 100 inbound-interface 'pppoe0'
+ set nat destination rule 100 inbound-interface name 'pppoe0'
set nat destination rule 100 protocol 'tcp'
set nat destination rule 100 translation address '192.0.2.40'
set nat destination rule 110 description 'NAT Reflection: INSIDE'
set nat destination rule 110 destination port '3389'
- set nat destination rule 110 inbound-interface 'eth0.10'
+ set nat destination rule 110 inbound-interface name 'eth0.10'
set nat destination rule 110 protocol 'tcp'
set nat destination rule 110 translation address '192.0.2.40'
set nat source rule 110 description 'NAT Reflection: INSIDE'
set nat source rule 110 destination address '192.0.2.0/24'
- set nat source rule 110 outbound-interface 'eth0.10'
+ set nat source rule 110 outbound-interface name 'eth0.10'
set nat source rule 110 protocol 'tcp'
set nat source rule 110 source address '192.0.2.0/24'
set nat source rule 110 translation address 'masquerade'
@@ -416,7 +466,9 @@ Which results in a configuration of:
destination {
port 3389
}
- inbound-interface pppoe0
+ inbound-interface {
+ name pppoe0
+ }
protocol tcp
translation {
address 192.0.2.40
@@ -427,7 +479,9 @@ Which results in a configuration of:
destination {
port 3389
}
- inbound-interface eth0.10
+ inbound-interface {
+ name eth0.10
+ }
protocol tcp
translation {
address 192.0.2.40
@@ -440,7 +494,9 @@ Which results in a configuration of:
destination {
address 192.0.2.0/24
}
- outbound-interface eth0.10
+ outbound-interface {
+ name eth0.10
+ }
protocol tcp
source {
address 192.0.2.0/24
@@ -479,7 +535,7 @@ Our configuration commands would be:
set nat destination rule 10 description 'Port Forward: HTTP to 192.168.0.100'
set nat destination rule 10 destination port '80'
- set nat destination rule 10 inbound-interface 'eth0'
+ set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '192.168.0.100'
@@ -494,7 +550,9 @@ Which would generate the following NAT destination configuration:
destination {
port 80
}
- inbound-interface eth0
+ inbound-interface {
+ name eth0
+ }
protocol tcp
translation {
address 192.168.0.100
@@ -510,43 +568,45 @@ Which would generate the following NAT destination configuration:
This establishes our Port Forward rule, but if we created a firewall
policy it will likely block the traffic.
-It is important to note that when creating firewall rules that the DNAT
+Firewall rules for Destination NAT
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+It is important to note that when creating firewall rules, the DNAT
translation occurs **before** traffic traverses the firewall. In other
words, the destination address has already been translated to
192.168.0.100.
-So in our firewall policy, we want to allow traffic coming in on the
-outside interface, destined for TCP port 80 and the IP address of
-192.168.0.100.
+So in our firewall ruleset, we want to allow traffic which previously matched
+a destination nat rule. In order to avoid creating many rules, one for each
+destination nat rule, we can accept all **'dnat'** connections with one simple
+rule, using ``connection-status`` matcher:
.. code-block:: none
- set firewall name OUTSIDE-IN rule 20 action 'accept'
- set firewall name OUTSIDE-IN rule 20 destination address '192.168.0.100'
- set firewall name OUTSIDE-IN rule 20 destination port '80'
- set firewall name OUTSIDE-IN rule 20 protocol 'tcp'
- set firewall name OUTSIDE-IN rule 20 state new 'enable'
+ set firewall ipv4 forward filter rule 10 action accept
+ set firewall ipv4 forward filter rule 10 connection-status nat destination
+ set firewall ipv4 forward filter rule 10 state new enable
This would generate the following configuration:
.. code-block:: none
- rule 20 {
- action accept
- destination {
- address 192.168.0.100
- port 80
- }
- protocol tcp
- state {
- new enable
+ ipv4 {
+ forward {
+ filter {
+ rule 10 {
+ action accept
+ connection-status {
+ nat destination
+ }
+ state {
+ new enable
+ }
+ }
+ }
}
}
-.. note::
-
- If you have configured the `INSIDE-OUT` policy, you will need to add
- additional rules to permit inbound NAT traffic.
1-to-1 NAT
----------
@@ -574,10 +634,10 @@ and one external interface:
set interfaces ethernet eth1 description 'Outside interface'
set nat destination rule 2000 description '1-to-1 NAT example'
set nat destination rule 2000 destination address '192.0.2.30'
- set nat destination rule 2000 inbound-interface 'eth1'
+ set nat destination rule 2000 inbound-interface name 'eth1'
set nat destination rule 2000 translation address '192.168.1.10'
set nat source rule 2000 description '1-to-1 NAT example'
- set nat source rule 2000 outbound-interface 'eth1'
+ set nat source rule 2000 outbound-interface name 'eth1'
set nat source rule 2000 source address '192.168.1.10'
set nat source rule 2000 translation address '192.0.2.30'
@@ -592,6 +652,40 @@ provide access to their internal resources, and require that a
connecting organisation translate all traffic to the service provider
network to a source address provided by the ASP.
+Load Balance
+------------
+Here we provide two examples on how to apply NAT Load Balance.
+
+First scenario: apply destination NAT for all HTTP traffic comming through
+interface eth0, and user 4 backends. First backend should received 30% of
+the request, second backend should get 20%, third 15% and the fourth 35%
+We will use source and destination address for hash generation.
+
+.. code-block:: none
+
+ set nat destination rule 10 inbound-interface name eth0
+ set nat destination rule 10 protocol tcp
+ set nat destination rule 10 destination port 80
+ set nat destination rule 10 load-balance hash source-address
+ set nat destination rule 10 load-balance hash destination-address
+ set nat destination rule 10 laod-balance backend 198.51.100.101 weight 30
+ set nat destination rule 10 laod-balance backend 198.51.100.102 weight 20
+ set nat destination rule 10 laod-balance backend 198.51.100.103 weight 15
+ set nat destination rule 10 laod-balance backend 198.51.100.104 weight 35
+
+Second scenario: apply source NAT for all outgoing connections from
+LAN 10.0.0.0/8, using 3 public addresses and equal distribution.
+We will generate the hash randomly.
+
+.. code-block:: none
+
+ set nat source rule 10 outbound-interface name eth0
+ set nat source rule 10 source address 10.0.0.0/8
+ set nat source rule 10 load-balance hash random
+ set nat source rule 10 load-balance backend 192.0.2.251 weight 33
+ set nat source rule 10 load-balance backend 192.0.2.252 weight 33
+ set nat source rule 10 load-balance backend 192.0.2.253 weight 34
+
Example Network
^^^^^^^^^^^^^^^
@@ -639,12 +733,10 @@ NAT Configuration
set nat source rule 110 description 'Internal to ASP'
set nat source rule 110 destination address '172.27.1.0/24'
- set nat source rule 110 outbound-interface 'any'
set nat source rule 110 source address '192.168.43.0/24'
set nat source rule 110 translation address '172.29.41.89'
set nat source rule 120 description 'Internal to ASP'
set nat source rule 120 destination address '10.125.0.0/16'
- set nat source rule 120 outbound-interface 'any'
set nat source rule 120 source address '192.168.43.0/24'
set nat source rule 120 translation address '172.29.41.89'
@@ -670,14 +762,12 @@ external interface in the image above)
.. code-block:: none
- set vpn ipsec ike-group my-ike ikev2-reauth 'no'
set vpn ipsec ike-group my-ike key-exchange 'ikev1'
set vpn ipsec ike-group my-ike lifetime '7800'
set vpn ipsec ike-group my-ike proposal 1 dh-group '14'
set vpn ipsec ike-group my-ike proposal 1 encryption 'aes256'
set vpn ipsec ike-group my-ike proposal 1 hash 'sha256'
- set vpn ipsec esp-group my-esp compression 'disable'
set vpn ipsec esp-group my-esp lifetime '3600'
set vpn ipsec esp-group my-esp mode 'tunnel'
set vpn ipsec esp-group my-esp pfs 'disable'
diff --git a/docs/configuration/nat/nat64.rst b/docs/configuration/nat/nat64.rst
new file mode 100644
index 00000000..e8a3a0e6
--- /dev/null
+++ b/docs/configuration/nat/nat64.rst
@@ -0,0 +1,81 @@
+.. _nat64:
+
+#####
+NAT64
+#####
+
+:abbr:`NAT64 (IPv6-to-IPv4 Prefix Translation)` is a critical component in
+modern networking, facilitating communication between IPv6 and IPv4 networks.
+This documentation outlines the setup, configuration, and usage of the NAT64
+feature in your project. Whether you are transitioning to IPv6 or need to
+seamlessly connect IPv4 and IPv6 devices.
+NAT64 is a stateful translation mechanism that translates IPv6 addresses to
+IPv4 addresses and IPv4 addresses to IPv6 addresses. NAT64 is used to enable
+IPv6-only clients to contact IPv4 servers using unicast UDP, TCP, or ICMP.
+
+
+Overview
+========
+
+Different NAT Types
+-------------------
+
+.. _source-nat64:
+
+SNAT64
+^^^^^^
+
+:abbr:`SNAT64 (IPv6-to-IPv4 Source Address Translation)` is a stateful
+translation mechanism that translates IPv6 addresses to IPv4 addresses.
+
+``64:ff9b::/96`` is the well-known prefix for IPv4-embedded IPv6 addresses.
+The prefix is used to represent IPv4 addresses in an IPv6 address format.
+The IPv4 address is encoded in the low-order 32 bits of the IPv6 address.
+The high-order 32 bits are set to the well-known prefix 64:ff9b::/96.
+
+
+Configuration Examples
+======================
+
+The following examples show how to configure NAT64 on a VyOS router.
+The 192.0.2.10 address is used as the IPv4 address for the translation pool.
+
+
+NAT64 server configuration:
+
+.. code-block:: none
+
+ set interfaces ethernet eth0 address '192.0.2.1/24'
+ set interfaces ethernet eth0 address '192.0.2.10/24'
+ set interfaces ethernet eth0 description 'WAN'
+ set interfaces ethernet eth1 address '2001:db8::1/64'
+ set interfaces ethernet eth1 description 'LAN'
+
+ set service dns forwarding allow-from '2001:db8::/64'
+ set service dns forwarding dns64-prefix '64:ff9b::/96'
+ set service dns forwarding listen-address '2001:db8::1'
+
+ set nat64 source rule 100 source prefix '64:ff9b::/96'
+ set nat64 source rule 100 translation pool 10 address '192.0.2.10'
+ set nat64 source rule 100 translation pool 10 port '1-65535'
+
+NAT64 client configuration:
+
+.. code-block:: none
+
+ set interfaces ethernet eth1 address '2001:db8::2/64'
+ set protocols static route6 64:ff9b::/96 next-hop 2001:db8::1
+ set system name-server '2001:db8::1'
+
+Test from the IPv6 only client:
+
+.. code-block:: none
+
+ vyos@r1:~$ ping 64:ff9b::192.0.2.1 count 2
+ PING 64:ff9b::192.0.2.1(64:ff9b::c000:201) 56 data bytes
+ 64 bytes from 64:ff9b::c000:201: icmp_seq=1 ttl=63 time=0.351 ms
+ 64 bytes from 64:ff9b::c000:201: icmp_seq=2 ttl=63 time=0.373 ms
+
+ --- 64:ff9b::192.0.2.1 ping statistics ---
+ 2 packets transmitted, 2 received, 0% packet loss, time 1023ms
+ rtt min/avg/max/mdev = 0.351/0.362/0.373/0.011 ms
diff --git a/docs/configuration/nat/nat66.rst b/docs/configuration/nat/nat66.rst
index 93dd3353..66cceb0a 100644
--- a/docs/configuration/nat/nat66.rst
+++ b/docs/configuration/nat/nat66.rst
@@ -82,7 +82,7 @@ Example:
.. code-block:: none
- set nat66 source rule 1 outbound-interface 'eth0'
+ set nat66 source rule 1 outbound-interface name 'eth0'
set nat66 source rule 1 source prefix 'fc01::/64'
set nat66 source rule 1 translation address 'fc00::/64'
@@ -101,7 +101,7 @@ Example:
.. code-block:: none
- set nat66 destination rule 1 inbound-interface 'eth0'
+ set nat66 destination rule 1 inbound-interface name 'eth0'
set nat66 destination rule 1 destination address 'fc00::/64'
set nat66 destination rule 1 translation address 'fc01::/64'
@@ -122,9 +122,9 @@ R1:
set interfaces ethernet eth0 ipv6 address autoconf
set interfaces ethernet eth1 address 'fc01::1/64'
set nat66 destination rule 1 destination address 'fc00:470:f1cd:101::/64'
- set nat66 destination rule 1 inbound-interface 'eth0'
+ set nat66 destination rule 1 inbound-interface name 'eth0'
set nat66 destination rule 1 translation address 'fc01::/64'
- set nat66 source rule 1 outbound-interface 'eth0'
+ set nat66 source rule 1 outbound-interface name 'eth0'
set nat66 source rule 1 source prefix 'fc01::/64'
set nat66 source rule 1 translation address 'fc00:470:f1cd:101::/64'
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-30 21:15:13 +0000