2 files changed, 40 insertions, 0 deletions
diff --git a/roles/nat/tasks/main.yml b/roles/nat/tasks/main.yml
new file mode 100644
index 0000000..6f5007b
--- /dev/null
+++ b/roles/nat/tasks/main.yml
@@ -0,0 +1,15 @@
+---
+- name: Configure source and destination NAT
+  vyos.vyos.vyos_nat:
+    config:
+      nat: >-
+        {{ ({'source': {'rule': nat_source_rules}} if nat_source_rules else {})
+           | combine({'destination': {'rule': nat_destination_rules}} if nat_destination_rules else {}) }}
+    state: "{{ _nat_state }}"
+  register: _nat_r
+  when: (nat_source_rules | length > 0) or (nat_destination_rules | length > 0)
+
+- name: Collect rendered commands  # noqa: var-naming[no-role-prefix] - shared across roles by design
+  ansible.builtin.set_fact:
+    vyos_blueprints_rendered: "{{ vyos_blueprints_rendered | default([]) + (_nat_r.rendered | default([])) }}"
+  when: vyos_blueprints_render_only | default(false) | bool
diff --git a/roles/nat/tasks/verify.yml b/roles/nat/tasks/verify.yml
new file mode 100644
index 0000000..a100d3a
--- /dev/null
+++ b/roles/nat/tasks/verify.yml
@@ -0,0 +1,25 @@
+---
+- name: Read NAT rules
+  vyos.vyos.vyos_command:
+    commands:
+      - show nat source rules
+      - show nat destination rules
+  register: _nat_v
+
+- name: Every source NAT rule is installed
+  ansible.builtin.assert:
+    that: _nat_v.stdout[0] is search('(?m)^\s*' ~ item.id ~ '\b')
+    fail_msg: "source NAT rule {{ item.id }} is not installed"
+    quiet: true
+  loop: "{{ nat_source_rules }}"
+  loop_control:
+    label: "{{ item.id }}"
+
+- name: Every destination NAT rule is installed
+  ansible.builtin.assert:
+    that: _nat_v.stdout[1] is search('(?m)^\s*' ~ item.id ~ '\b')
+    fail_msg: "destination NAT rule {{ item.id }} is not installed"
+    quiet: true
+  loop: "{{ nat_destination_rules }}"
+  loop_control:
+    label: "{{ item.id }}"