diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/vpp/configuration/nat/cgnat.rst | 84 | ||||
| -rw-r--r-- | docs/vpp/configuration/nat/index.rst | 22 | ||||
| -rw-r--r-- | docs/vpp/configuration/nat/nat44.rst | 306 |
3 files changed, 258 insertions, 154 deletions
diff --git a/docs/vpp/configuration/nat/cgnat.rst b/docs/vpp/configuration/nat/cgnat.rst index 2f1e2e1a..3cef3dce 100644 --- a/docs/vpp/configuration/nat/cgnat.rst +++ b/docs/vpp/configuration/nat/cgnat.rst @@ -1,4 +1,4 @@ -:lastproofread: 2025-09-04 +:lastproofread: 2026-03-03 .. _vpp_config_nat_cgnat: @@ -8,37 +8,35 @@ VPP CGNAT Configuration ####################### -The Carrier-grade NAT (CGNAT) is a special type of NAT mainly targeted for -usage by Internet Service Providers (ISPs) to manage the limited pool of -public IP addresses. It solves two main problems: +Carrier-grade NAT (CGNAT) is a NAT type designed for Internet Service +Providers (ISPs) to manage limited pools of public IP addresses. It +solves two main problems: -* allows to fairly share a limited number of public IP addresses between - multiple customers, ensuring they all have access to the internet and cannot - interfere with each other. -* allows to track and log the usage of public IP addresses by different - customers, which is often a regulatory requirement. +* Enables fair sharing of a limited number of public IP addresses among + multiple customers, ensuring all have internet access without interfering + with each other. +* Enables tracking and logging of public IP address usage by different + customers, which is often a regulatory requirement. -The CGNAT configuration is a straightforward process. It involves defining the -inside and outside interfaces and creating the necessary rules to manage the -translation of private IP addresses to public IP addresses. +CGNAT configuration is straightforward. Define the inside and outside +interfaces, then create rules to manage the translation of private IP +addresses to public IP addresses. .. warning:: - **Enabling CGNAT** on an interface (both inside and outside) **disables - normal routing** on these interfaces, **also as an management access** to - VyOS router itself. - + **Enabling CGNAT** on an interface (both inside and outside) + **disables normal routing** on these interfaces and **blocks management + access** to the VyOS router itself. + Ensure you have an alternative management path to the router before applying - CGNAT configuration! If router-local traffic (for example SSH or DNS) must - remain reachable on a CGNAT interface, configure appropriate CGNAT exclude - rules. + your CGNAT configuration. Interface Configuration ----------------------- -First, you need to define the inside and outside interfaces. The inside -interface is connected to the private network, while the outside interface is -connected to the public network. +Define the inside and outside interfaces. The inside interface connects +to the private network, while the outside interface connects to the public +network. .. cfgcmd:: @@ -60,19 +58,19 @@ Next, you need to create the NAT rules. set vpp nat cgnat rule <rule-number> description <description> -Allows you to describe the rule for easier identification. +Add a description to the rule for easier identification. .. cfgcmd:: set vpp nat cgnat rule <rule-number> inside-prefix <inside-prefix> -Sets the inside prefix (private IP range) that will be translated. +Specify the inside prefix (private IP range) to translate. .. cfgcmd:: set vpp nat cgnat rule <rule-number> outside-prefix <outside-prefix> -Sets the outside prefix (public IP range) that will be used for translation. +Specify the outside prefix (public IP range) to use for translation. Exclude Rules Configuration --------------------------- @@ -112,9 +110,9 @@ Matches a specific local port (or ICMP identifier in case of ICMP protocol). Exclude-rule validation rules: * ``local-address`` must be specified. - * ``protocol`` and ``local-port`` must either both be specified or both be + * ``protocol`` and ``local-port`` must either both be specified or both be omitted. - * Duplicate identity mappings are not allowed (same local-address, + * Duplicate identity mappings are not allowed (same local-address, protocol, local-port tuple). .. note:: @@ -129,12 +127,12 @@ Matches a specific local port (or ICMP identifier in case of ICMP protocol). CGNAT memory usage scales with the number of internal customers. - **Each 256 customers** (equivalent to a /24 subnet) requires approximately - **4 MB of main heap memory**. This memory is used for maintaining + **Each 256 customers** (equivalent to a /24 subnet) requires + approximately **4 MB of main heap memory**. This memory maintains customer-to-port mappings and session state information. - Ensure your VPP main heap size is configured appropriately based on your - expected customer count. See :ref:`VPP Memory Configuration + Configure your VPP main heap size appropriately based on your expected + customer count. See :ref:`VPP Memory Configuration <vpp_config_dataplane_memory>` for details on adjusting main heap size. Session Limitations @@ -142,18 +140,18 @@ Session Limitations CGNAT has built-in session limitations to ensure fair resource allocation: -**Each customer (internal IP address) is limited to a maximum of 1000 -simultaneous sessions**, even if more than 1000 ports are allocated to that -customer. This limitation applies to all types of sessions (TCP, UDP, ICMP). +Each customer (internal IP address) is limited to a maximum of 1000 +simultaneous sessions, even if more than 1000 ports are allocated to that +customer. This limitation applies to all session types (TCP, UDP, ICMP). Timeouts Configuration ---------------------- -In some cases, you might want to adjust the timers for the NAT sessions. This -can help to optimize the address space usage by controlling how long a session -remains active, and how long it occupies an IP address and port combination. +You can adjust NAT session timers to optimize address space usage by +controlling how long sessions remain active and how long they occupy IP +address and port combinations. -This setting can be adjusted for different protocols individually: +Adjust these settings for different protocols individually: .. code-block:: @@ -165,7 +163,7 @@ This setting can be adjusted for different protocols individually: Example Configuration --------------------- -Here is an example configuration for a CGNAT setup, assuming: +Here is an example CGNAT configuration with these assumptions: * Inside interface: ``eth2`` * Outside interface: ``eth1`` @@ -209,14 +207,14 @@ Displays the configured inside and outside interfaces. show vpp nat cgnat sessions -Displays the active NAT sessions. Be aware that this command can produce a -large amount of output if there are many active sessions. +Display active NAT sessions. This command may produce extensive output if +many sessions are active. .. opcmd:: show vpp nat cgnat mappings -Displays the current NAT mappings, including inside and outside address +Display current NAT mappings, including inside and outside address prefixes. .. code-block:: @@ -244,7 +242,7 @@ Displays configured CGNAT exclude rules (identity mappings). Potential Issues and Troubleshooting ==================================== -Configuration is failed to apply with error similar to: +Configuration fails to apply with an error similar to: .. code-block:: diff --git a/docs/vpp/configuration/nat/index.rst b/docs/vpp/configuration/nat/index.rst index 34110651..8946ca3b 100644 --- a/docs/vpp/configuration/nat/index.rst +++ b/docs/vpp/configuration/nat/index.rst @@ -1,4 +1,4 @@ -:lastproofread: 2025-09-04 +:lastproofread: 2026-03-05 .. _vpp_config_nat_index: @@ -21,22 +21,20 @@ VPP Dataplane in VyOS supports two types of NAT: NAT44 ===== -This type is a classical NAT implementation where you can configure static and -dynamic NAT rules. It supports both source and destination NAT - while the -configuration may looks a bit unusual in comparison to traditional NAT -implementations. +This type is a classic NAT implementation where you can configure static +and dynamic NAT rules. It supports both source and destination NAT. While the +configuration may look a bit unusual compared to traditional NAT +implementations, it provides flexibility in network configurations. CGNAT ===== -CGNAT is a special type of NAT44, which is highly useful for use cases where -you have multiple local customers with a limited number of public IP -addresses, and want to share public IP address space fairly between them. It -uses a combination of IP address and port number to distinguish between -different customers. +CGNAT is a special type of NAT44, which is highly useful when you have +multiple local customers and a limited number of public IP addresses. It +shares the public IP address space fairly between customers by using a +combination of IP address and port number to distinguish between them. -This type of NAT is often used by ISPs to provide internet access to their -customers. +ISPs often use this NAT type to provide internet access to customers. It supports only source NAT. diff --git a/docs/vpp/configuration/nat/nat44.rst b/docs/vpp/configuration/nat/nat44.rst index 243bfbf0..9f736f76 100644 --- a/docs/vpp/configuration/nat/nat44.rst +++ b/docs/vpp/configuration/nat/nat44.rst @@ -1,4 +1,4 @@ -:lastproofread: 2025-09-04 +:lastproofread: 2026-03-05 .. _vpp_config_nat_nat44: @@ -10,102 +10,132 @@ VPP NAT44 Configuration NAT44 has two main use cases: -* **Source NAT (SNAT)**: Enabling Internet access for hosts in private networks using dynamic or static address translation -* **Destination NAT (DNAT)**: Providing external access to internal services through static port forwarding rules +* **Source NAT (SNAT)**: Enabling internet access for hosts in private + networks using dynamic or static address translation. +* **Destination NAT (DNAT)**: Providing external access to internal services + through static port forwarding rules. -VyOS supports both dynamic translation using address pools and static mappings for predictable address translation requirements. +VyOS supports both dynamic translation using address pools and static +mappings for predictable address translation requirements. -Configuration of NAT44 involves few steps: +Configuring NAT44 involves a few steps: 1. Define the inside and outside interfaces. -2. Create NAT rules for SNAT and/or DNAT. +2. Create NAT rules for SNAT or DNAT. Dynamic and Static Operations ============================= -NAT44 configuration can be done in one of two ways or in both ways simultaneously: +NAT44 configuration can be done in one of two ways or in both ways +simultaneously: 1. Dynamically performing NAT using a pool of public IP addresses. 2. Statically mapping private IP addresses to public IP addresses. -To configure dynamic NAT, you need to define a pool of public IP addresses that will be used for translation. This offers an easy way to provide Internet access to internal users. +To configure dynamic NAT, you need to define a pool of public IP +addresses that will be used for translation. This offers an easy way to +provide internet access to internal users. -Static rules are more suitable for scenarios where you need to provide consistent and predictable mappings between private and public IP addresses, also they are the only way to configure DNAT. +Static rules are suitable for scenarios where you need consistent and +predictable mappings between private and public IP addresses. They are also +the only way to configure DNAT. NAT Rule Processing and Traffic Flow ------------------------------------ -This section explains how different combinations of NAT rules affect traffic handling on a router. There are three possible combinations of NAT rules configurations: +This section explains how different combinations of NAT rules affect +traffic handling on a router. There are three possible combinations of NAT +rule configurations: 1. **Dynamic NAT Only** - * **All** traffic received on the "in" interface is processed by dynamic NAT rules without exceptions. + * **All** traffic received on the "in" interface is processed by + dynamic NAT rules without exceptions. 2. **Dynamic + Static NAT** - * **All** traffic received on the "in" interface is first matched against static NAT rules. - * If no match is found, it is then processed by dynamic NAT rules. + * **All** traffic received on the "in" interface is first matched + against static NAT rules. + * If no match is found, it is then processed against dynamic NAT rules. 3. **Static NAT Only** - * **All** traffic on the "in" interface is checked against static NAT rules. + * **All** traffic on the "in" interface is checked against static NAT + rules. * If no match is found, the traffic is routed **without NAT**. .. important:: - * If **dynamic NAT rules** are present, **all** traffic received on "in" interfaces is subject to NAT processing. - * If **only static NAT rules** are configured, traffic that does not match any static rule is routed unchanged. + * If **dynamic NAT rules** are present, **all** traffic received on + "in" interfaces is subject to NAT processing. + * If **only static NAT rules** are configured, traffic that does not + match any static rule is routed unchanged. Interfaces Configuration ======================== -The first step in configuring NAT44 is defining which interfaces handle inside (private) and outside (public) traffic. VyOS uses these interface designations to determine the direction of translation. +The first step in configuring NAT44 is defining which interfaces handle +inside (private) and outside (public) traffic. VyOS uses these interface +designations to determine the direction of translation. Inside Interfaces ----------------- -Inside interfaces connect to private networks where hosts need source NAT to access external networks. +Inside interfaces connect to private networks where hosts need source NAT +to access external networks. .. cfgcmd:: set vpp nat nat44 interface inside <inside-interface> -Traffic flowing **from** inside interfaces gets source NAT applied, translating private source addresses to public addresses from the translation pool. +Traffic flowing **from** inside interfaces gets source NAT applied, +translating private source addresses to public addresses from the +translation pool. Outside Interfaces ------------------ -Outside interfaces connect to public networks where external hosts may need to access internal services. +Outside interfaces connect to public networks where external hosts may +need to access internal services. .. cfgcmd:: set vpp nat nat44 interface outside <outside-interface> -Traffic flowing **to** outside interfaces can trigger destination NAT based on static rules, allowing external access to internal services. +Traffic flowing **to** outside interfaces can trigger destination NAT +based on static rules, allowing external access to internal services. Interface Roles and Traffic Flow -------------------------------- .. note:: - While we commonly use "inside" and "outside" as established conventions, the technical definitions are: + While VyOS uses "inside" and "outside" as established conventions, + the technical definitions are: - * **Inside interface**: Interface where traffic originates that needs source NAT (SNAT) - * **Outside interface**: Interface where traffic originates that needs destination NAT (DNAT) + * **Inside interface**: Interface where traffic originates that needs + source NAT (SNAT) + * **Outside interface**: Interface where traffic originates that needs + destination NAT (DNAT) - In complex network topologies, the same physical interface can be configured as both inside and outside to handle bidirectional NAT scenarios. + In complex network topologies, the same physical interface can be + configured as both inside and outside to handle bidirectional NAT + scenarios. **Traffic Processing:** 1. **Inside → Outside** (SNAT): Private hosts accessing external networks -2. **Outside → Inside** (DNAT): External hosts accessing internal services via static rules +2. **Outside → Inside** (DNAT): External hosts accessing internal services + via static rules 3. **Dynamic NAT**: Created automatically for inside→outside traffic -4. **Static NAT**: Requires explicit configuration for outside→inside traffic +4. **Static NAT**: Requires explicit configuration for outside→inside + traffic Multiple Interface Support -------------------------- -You can configure multiple interfaces as inside or outside to support complex network topologies: +You can configure multiple interfaces as inside or outside to support +complex network topologies: .. code-block:: none @@ -120,16 +150,21 @@ You can configure multiple interfaces as inside or outside to support complex ne Address Pool Configuration ========================== -Address pools define ranges of IP addresses that can be used for NAT translations. VyOS NAT44 supports two types of address pools, each serving different purposes. +Address pools define ranges of IP addresses that can be used for NAT +translations. VyOS NAT44 supports two types of address pools, each serving +different purposes. Translation Pools ----------------- -Translation pools are used for dynamic source NAT (SNAT). They provide a range of public IP addresses that can be dynamically assigned to private hosts when they access external networks. +Translation pools are used for dynamic source NAT (SNAT). They provide a +range of public IP addresses that can be dynamically assigned to private +hosts when they access external networks. .. cfgcmd:: - set vpp nat nat44 address-pool translation address <ip-address | ip-address-range> + set vpp nat nat44 address-pool translation address + <ip-address | ip-address-range> .. cfgcmd:: @@ -151,7 +186,9 @@ Translation pools are used for dynamic source NAT (SNAT). They provide a range o Twice-NAT Pools --------------- -Twice-NAT pools are used when performing both source and destination NAT on the same traffic flow. This is particularly useful in scenarios where you need to: +Twice-NAT pools are used when performing both source and destination NAT on +the same traffic flow. This is particularly useful in scenarios where you +need to: * Translate both source and destination addresses * Provide access between networks with overlapping IP ranges @@ -159,7 +196,8 @@ Twice-NAT pools are used when performing both source and destination NAT on the .. cfgcmd:: - set vpp nat nat44 address-pool twice-nat address <ip-address | ip-address-range> + set vpp nat nat44 address-pool twice-nat address + <ip-address | ip-address-range> .. cfgcmd:: @@ -180,38 +218,52 @@ Pool Requirements .. important:: - * For dynamic NAT to work, you must configure at least one **translation** pool - * For static rules with twice-nat options, you must configure a **twice-nat** pool - * Interface-based pools automatically include main (first) IP address assigned to the specified interface + * For dynamic NAT to work, you must configure at least one + **translation** pool. + * For static rules with twice-nat options, you must configure a + **twice-nat** pool. + * Interface-based pools automatically include main (first) IP address + assigned to the specified interface. Pool Selection Priority ----------------------- -When multiple pools are configured, VyOS uses the following selection priority: +When multiple pools are configured, VyOS uses the following selection +priority: -1. **Static mappings**: Always use the specific external address defined in the rule -2. **Dynamic NAT**: Use available addresses from translation pools in the order they were configured -3. **Twice-NAT**: Use addresses from twice-nat pools for secondary translation +1. **Static mappings**: Always use the specific external address defined in + the rule. +2. **Dynamic NAT**: Use available addresses from translation pools in the + order they were configured. +3. **Twice-NAT**: Use addresses from twice-nat pools for secondary + translation. .. note:: - As soon as you have configured interfaces and pool, the NAT44 is operational. + As soon as you have configured interfaces and pool, the NAT44 is + operational. Static Rules Configuration ========================== -Static NAT rules provide predictable and consistent mappings between private and public IP addresses. They are essential for: +Static NAT rules provide predictable and consistent mappings between private +and public IP addresses. They are essential for: -* **Destination NAT (DNAT)**: Allowing external hosts to access services in the private network -* **Server publishing**: Making internal services available from the internet -* **Consistent mappings**: Ensuring the same private IP always maps to the same public IP +* **Destination NAT (DNAT)**: Allowing external hosts to access services in + the private network. +* **Server publishing**: Making internal services available from the + Internet. +* **Consistent mappings**: Ensuring the same private IP always maps to the + same public IP. -Unlike dynamic NAT that uses a pool of addresses, static rules create one-to-one mappings that persist until explicitly removed. +Unlike dynamic NAT that uses a pool of addresses, static rules create +one-to-one mappings that persist until explicitly removed. Basic Static Rule Configuration ------------------------------- -To create a static NAT rule, you need to define the local (internal) and external (public) address mappings: +To create a static NAT rule, you need to define the local (internal) and +external (public) address mappings: .. cfgcmd:: @@ -227,12 +279,15 @@ Where: * ``<internal-ip>`` is the private IP address in your local network * ``<external-ip>`` is the public IP address that external hosts will use -This basic configuration creates a static one-to-one mapping. Traffic from outside to the external IP will be translated to the internal IP, and vice versa. +This basic configuration creates a static one-to-one mapping. Traffic from +outside to the external IP will be translated to the internal IP, and vice +versa. Port-based Static Rules ----------------------- -For more granular control, you can create port-specific static rules. This is useful when you want to publish specific services: +For more granular control, you can create port-specific static rules. This +is useful when you want to publish specific services: .. cfgcmd:: @@ -256,14 +311,16 @@ For more granular control, you can create port-specific static rules. This is us Where: -* ``<internal-port>`` and ``<external-port>`` are the port numbers used by the connection -* ``<protocol>`` specifies the protocol (tcp, udp, icmp) +* ``<internal-port>`` and ``<external-port>`` are the port numbers used by + the connection. +* ``<protocol>`` specifies the protocol (tcp, udp, icmp). .. important:: - If you do not specify ports and protocol, the rule will apply to all traffic between the specified internal and external addresses. + If you do not specify ports and protocol, the rule will apply to *all* + traffic between the specified internal and external addresses. - Rules must contain either both ports and protocol or neither. + Rules must contain either both ports and protocol, or neither. Advanced Static Rule Options ---------------------------- @@ -273,9 +330,12 @@ VyOS NAT44 supports several advanced options for static rules: Twice-NAT ^^^^^^^^^ -Twice-NAT performs both source and destination NAT. So when an external host accesses an internal service, a source IP of such connection is translated to an address from the twice-NAT address pool. +Twice-NAT performs both source and destination NAT. When an external host +accesses an internal service, the source IP of such a connection is +translated to an address from the twice-NAT address pool. -This is practical in scenarios where internal services cannot connect public networks, so they may see such traffic as internal. +This is practical in scenarios where internal services cannot connect to +public networks, so they see such traffic as internal. The twice-NAT option can be enabled with the following command: @@ -286,38 +346,47 @@ The twice-NAT option can be enabled with the following command: Self Twice-NAT ^^^^^^^^^^^^^^ -Self Twice-NAT is used when a local host needs to access itself via the external address: +Self Twice-NAT is used when a local host needs to access itself via the +external address: .. cfgcmd:: set vpp nat nat44 static rule <rule-number> options self-twice-nat -This option rewrites source IP addresses on packets sent only from a local address to an external address configured in a rule. +This option rewrites source IP addresses on packets sent only from a local +address to an external address configured in a rule. .. important:: - * Using self-twice-nat option requires to set interface connected to the local network as both inside and outside interface, because both source and destination NAT need to be applied. - * External IP address used in static rules must belong to one of the configured translation pools + * Using ``self-twice-nat`` option requires you to set the interface + connected to the local network as both inside and outside, because + both source and destination NAT need to be applied. + * External IP address used in static rules must belong to one of the + configured translation pools. Out-to-In Only ^^^^^^^^^^^^^^ -Restricts the rule to only apply to traffic from outside to inside interfaces: +Restricts the rule to only apply to traffic from outside to inside +interfaces: .. cfgcmd:: set vpp nat nat44 static rule <rule-number> options out-to-in-only -This prevents the creation of sessions from the inside interface, making it purely a DNAT rule. +This prevents the creation of sessions from the inside interface, making it +a purely DNAT rule. Force Twice-NAT Address ^^^^^^^^^^^^^^^^^^^^^^^ -When using twice-nat, you can force the use of a specific IP address from the twice-nat address pool: +When using twice-nat, you can force the use of a specific IP address from +the twice-nat address pool: .. cfgcmd:: - set vpp nat nat44 static rule <rule-number> options twice-nat-address <ip-address> + set vpp nat nat44 static rule <rule-number> options twice-nat-address + <ip-address> Rule Description ^^^^^^^^^^^^^^^^ @@ -364,25 +433,33 @@ Static Rules Configuration Examples .. note:: - When using twice-nat or self-twice-nat options, ensure you have configured a twice-nat address pool using: + When using twice-nat or self-twice-nat options, ensure you have + configured a twice-nat address pool using: ``set vpp nat nat44 address-pool twice-nat address <twice-nat-ip-range>`` Exclude Rules Configuration =========================== -Exclude rules allow you to prevent specific traffic from undergoing NAT translation. This is particularly useful for: +Exclude rules allow you to prevent specific traffic from undergoing NAT +translation. This is particularly useful for: -* **Router management**: Allowing SSH access to the router itself from external networks +* **Router management**: Allowing SSH access to the router itself from + external networks. * **Service bypass**: Excluding specific services from NAT processing -* **Traffic forwarding**: Allowing forwarded traffic to bypass NAT with 1-to-1 mapping +* **Traffic forwarding**: Allowing forwarded traffic to bypass NAT with 1-to-1 + mapping. -Exclude rules take precedence over both dynamic and static NAT rules, ensuring that matching traffic bypasses NAT processing. For forwarded traffic, exclude rules create invisible 1-to-1 mappings that allow packets to pass through without NAT modifications. +Exclude rules take precedence over both dynamic and static NAT rules, +ensuring that matching traffic bypasses NAT processing. For forwarded +traffic, exclude rules create invisible 1-to-1 mappings that allow packets +to pass through without NAT modifications. Basic Exclude Rule Configuration -------------------------------- -To create an exclude rule, you need to specify the traffic characteristics that should bypass NAT. You can configure exclude rules in two ways: +To create an exclude rule, you need to specify the traffic characteristics +that should bypass NAT. You can configure exclude rules in two ways: **Option 1: Using local address** @@ -394,22 +471,29 @@ To create an exclude rule, you need to specify the traffic characteristics that .. cfgcmd:: - set vpp nat nat44 exclude rule <rule-number> external-interface <interface-name> + set vpp nat nat44 exclude rule <rule-number> external-interface + <interface-name> Where: -* ``<rule-number>`` is a unique identifier for the exclude rule -* ``<internal-ip>`` is the local IP address that should be excluded from NAT -* ``<interface-name>`` is the external interface where the traffic originates +* ``<rule-number>`` is a unique identifier for the exclude rule. +* ``<internal-ip>`` is the local IP address that should be excluded from + NAT. +* ``<interface-name>`` is the external interface where the traffic + originates. .. important:: - You must use either ``local-address`` OR ``external-interface`` in an exclude rule, but not both simultaneously. These options are mutually exclusive. + You must use either ``local-address`` OR ``external-interface`` in an + exclude rule, but not both simultaneously. These options are mutually + exclusive. Port-specific Exclude Rules --------------------------- -For more granular control, you can exclude only specific ports and protocols. You can combine port and protocol specifications with either local-address or external-interface: +For more granular control, you can exclude only specific ports and protocols. +You can combine port and protocol specifications with either ``local-address`` or +``external-interface``: **With local address:** @@ -429,7 +513,8 @@ For more granular control, you can exclude only specific ports and protocols. Yo .. cfgcmd:: - set vpp nat nat44 exclude rule <rule-number> external-interface <interface-name> + set vpp nat nat44 exclude rule <rule-number> external-interface + <interface-name> .. cfgcmd:: @@ -507,49 +592,64 @@ Common Use Cases **Router Administration:** -Exclude rules are essential when you need to manage the router from external networks. Without exclude rules, NAT would attempt to translate the router's own traffic, potentially breaking management connections. +Exclude rules are essential when you need to manage the router from external +networks. Without exclude rules, NAT would attempt to translate the router's +own traffic, potentially breaking management connections. **Service Monitoring:** -Network monitoring systems often need direct access to router services. Exclude rules ensure that monitoring traffic bypasses NAT translation. +Network monitoring systems often need direct access to router services. +Exclude rules ensure that monitoring traffic bypasses NAT translation. **Routing Protocols:** -Some routing protocols or network services may require direct communication without NAT interference. +Some routing protocols or network services may require direct communication +without NAT interference. **Traffic Forwarding:** -Exclude rules also work for forwarded traffic between networks. Without exclude rules, traffic from external to local networks must either match a static rule or be dropped. With exclude rules, traffic can bypass NAT processing with invisible 1-to-1 mappings. +Exclude rules also work for forwarded traffic between networks. Without +exclude rules, traffic from external to local networks must either match a +static rule or be dropped. With exclude rules, traffic can bypass NAT +processing with invisible 1-to-1 mappings. .. important:: - Exclude rules affect both traffic destined for the router itself and forwarded traffic flowing through the router. For forwarded traffic, exclude rules create transparent 1-to-1 mappings that allow packets to pass without NAT modifications, while from the outside perspective, the traffic appears to bypass NAT entirely. + Exclude rules affect both traffic destined for the router itself and + forwarded traffic flowing through the router. For forwarded traffic, exclude + rules create transparent 1-to-1 mappings that allow packets to pass without + NAT modifications, while from the outside perspective, the traffic appears to + bypass NAT entirely. Advanced NAT44 Settings ======================= -VyOS provides additional NAT44 settings for fine-tuning performance and behavior. +VyOS provides additional NAT44 settings for fine-tuning performance and +behavior. Session Timeouts ---------------- -NAT44 maintains translation sessions with configurable timeout values for different protocols: +NAT44 maintains translation sessions with configurable timeout values for +different protocols: .. cfgcmd:: set vpp nat nat44 timeout icmp <seconds> - Set the timeout for ICMP sessions. Default: 60 seconds. + Set the timeout for ICMP sessions (Default: 60 seconds). .. cfgcmd:: set vpp nat nat44 timeout tcp-established <seconds> - Set the timeout for established TCP connections. Default: 7440 seconds (2 hours 4 minutes). + Set the timeout for established TCP connections (Default: 7440 seconds + or 2 hours 4 minutes). .. cfgcmd:: set vpp nat nat44 timeout tcp-transitory <seconds> - Set the timeout for transitory TCP connections (connection setup/teardown). Default: 240 seconds (4 minutes). + Set the timeout for transitory TCP connections (setup/teardown) (Default: + 240 seconds or 4 minutes). .. cfgcmd:: set vpp nat nat44 timeout udp <seconds> - Set the timeout for UDP sessions. Default: 300 seconds (5 minutes). + Set the timeout for UDP sessions (Default: 300 seconds or 5 minutes). **Example:** @@ -567,9 +667,11 @@ Control the maximum number of concurrent NAT sessions: .. cfgcmd:: set vpp nat nat44 session-limit <number> - Set the maximum number of NAT sessions per worker thread. Default: 64512. + Set the maximum number of NAT sessions per worker thread (Default: + 64512). -This setting helps prevent memory exhaustion and ensures predictable performance under high load. +This setting helps prevent memory exhaustion and ensures predictable +performance under high load. **Example:** @@ -581,7 +683,8 @@ This setting helps prevent memory exhaustion and ensures predictable performance Complete Configuration Example ============================== -Here's a complete example showing how to configure VyOS NAT44 for a typical network setup: +Here's a complete example showing how to configure VyOS NAT44 for a typical +network setup: **Network Topology:** @@ -663,11 +766,14 @@ Recommendations --------------- * **Use exclude rules** for router management services like SSH -* **Use out-to-in-only** for services that do not need access to external networks -* **Limit port ranges** in static rules to only necessary ports -* **Document all rules** using descriptions for easier management -* **Use non-standard ports** for publishing SSH and other administrative services -* **Configure appropriate pool sizes** based on expected concurrent connections in your network +* **Use out-to-in-only** for services that do not need access to external + networks. +* **Limit port ranges** in static rules to only necessary ports. +* **Document all rules** using descriptions for easier management. +* **Use non-standard ports** for publishing SSH and other administrative + services. +* **Configure appropriate pool sizes** based on expected concurrent + connections in your network. Common Configuration Issues --------------------------- @@ -675,7 +781,7 @@ Common Configuration Issues **Static rules not working:** 1. Verify that the external IP address is included in an address pool -2. Check that interfaces are correctly configured as inside/outside +2. Check that interfaces are correctly configured as inside or outside 3. Ensure firewall rules allow the traffic **Twice-NAT not functioning:** @@ -693,13 +799,15 @@ Common Configuration Issues **Forwarded traffic from external networks not bypassing NAT:** 1. Verify exclude rules are configured for the specific traffic flow -2. Check that local-address matches the destination IP in the internal network +2. Check that local-address matches the destination IP in the internal + network 3. Ensure protocol and port specifications match the traffic requirements Operational Commands ==================== -Monitor NAT44 status and active connections using VyOS operational commands: +Monitor NAT44 status and active connections using VyOS operational +commands: .. opcmd:: show vpp nat nat44 addresses @@ -707,7 +815,7 @@ Monitor NAT44 status and active connections using VyOS operational commands: .. opcmd:: show vpp nat nat44 interfaces - Show which interfaces are configured as inside/outside for NAT44. + Show which interfaces are configured as inside or outside for NAT44. .. opcmd:: show vpp nat nat44 sessions |