T8323: vyos_nat module (#451)

Add NAT module

19 files changed, 923 insertions, 0 deletions

diff --git a/tests/integration/targets/vyos_nat/defaults/main.yaml b/tests/integration/targets/vyos_nat/defaults/main.yaml
new file mode 100644
index 00000000..164afead
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/defaults/main.yaml
@@ -0,0 +1,3 @@
+---
+testcase: "[^_].*"
+test_items: []
diff --git a/tests/integration/targets/vyos_nat/tasks/cli.yaml b/tests/integration/targets/vyos_nat/tasks/cli.yaml
new file mode 100644
index 00000000..a71206c0
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tasks/cli.yaml
@@ -0,0 +1,20 @@
+---
+- name: Collect all cli test cases
+  ansible.builtin.find:
+    paths: "{{ role_path }}/tests/cli"
+    patterns: "{{ testcase }}\\.yaml$"
+    use_regex: true
+  delegate_to: localhost
+  register: test_cases
+
+- name: Set test_items
+  ansible.builtin.set_fact:
+    test_items: "{{ test_cases.files | map(attribute='path') | list }}"
+
+- name: Run test case (connection=ansible.netcommon.network_cli)
+  ansible.builtin.include_tasks: "{{ test_case_to_run }}"
+  vars:
+    ansible_connection: ansible.netcommon.network_cli
+  with_items: "{{ test_items }}"
+  loop_control:
+    loop_var: test_case_to_run
diff --git a/tests/integration/targets/vyos_nat/tasks/main.yaml b/tests/integration/targets/vyos_nat/tasks/main.yaml
new file mode 100644
index 00000000..e6378581
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tasks/main.yaml
@@ -0,0 +1,5 @@
+---
+- name: Run CLI tests
+  ansible.builtin.include_tasks: cli.yaml
+  tags:
+    - network_cli
diff --git a/tests/integration/targets/vyos_nat/tests/cli/_parsed.cfg b/tests/integration/targets/vyos_nat/tests/cli/_parsed.cfg
new file mode 100644
index 00000000..68375366
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/_parsed.cfg
@@ -0,0 +1,17 @@
+set nat destination rule 100 description 'Web server NAT'
+set nat destination rule 100 destination address '198.51.100.10'
+set nat destination rule 100 destination port '80'
+set nat destination rule 100 inbound-interface name 'eth2'
+set nat destination rule 100 log
+set nat destination rule 100 protocol 'tcp'
+set nat destination rule 100 translation address '192.168.1.10'
+set nat destination rule 100 translation port '8080'
+set nat source rule 200 description 'Outbound NAT'
+set nat source rule 200 destination address '192.168.10.100'
+set nat source rule 200 destination port '8083'
+set nat source rule 200 disable
+set nat source rule 200 exclude
+set nat source rule 200 log
+set nat source rule 200 protocol 'tcp'
+set nat source rule 200 translation address 'masquerade'
+set nat source rule 200 translation port '443'
diff --git a/tests/integration/targets/vyos_nat/tests/cli/_populate.yaml b/tests/integration/targets/vyos_nat/tests/cli/_populate.yaml
new file mode 100644
index 00000000..a3715be9
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/_populate.yaml
@@ -0,0 +1,8 @@
+---
+- ansible.builtin.include_tasks: _remove_config.yaml
+
+- name: Setup NAT configuration
+  vyos.vyos.vyos_config:
+    lines: "{{ populate_config }}"
+  vars:
+    ansible_connection: ansible.netcommon.network_cli
diff --git a/tests/integration/targets/vyos_nat/tests/cli/_remove_config.yaml b/tests/integration/targets/vyos_nat/tests/cli/_remove_config.yaml
new file mode 100644
index 00000000..3618bf40
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/_remove_config.yaml
@@ -0,0 +1,10 @@
+---
+- name: Remove NAT configuration
+  vyos.vyos.vyos_config:
+    lines:
+      - delete nat
+      - delete nat64
+      - delete nat66
+  ignore_errors: true
+  vars:
+    ansible_connection: ansible.netcommon.network_cli
diff --git a/tests/integration/targets/vyos_nat/tests/cli/deleted.yaml b/tests/integration/targets/vyos_nat/tests/cli/deleted.yaml
new file mode 100644
index 00000000..c08d6b1c
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/deleted.yaml
@@ -0,0 +1,34 @@
+---
+- debug:
+    msg: START vyos_nat deleted integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Delete all NAT configuration
+      register: result
+      vyos.vyos.vyos_nat: &id001
+        config:
+        state: deleted
+
+    - assert:
+        that:
+          - result.changed == true
+          - result.commands|symmetric_difference(deleted.commands) == []
+
+    - name: Assert that the after dicts were correctly generated
+      assert:
+        that:
+          - result.after|symmetric_difference(deleted.after) == []
+
+    - name: Delete the existing configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_nat: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/deleted_full_match.yaml b/tests/integration/targets/vyos_nat/tests/cli/deleted_full_match.yaml
new file mode 100644
index 00000000..43a8124f
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/deleted_full_match.yaml
@@ -0,0 +1,70 @@
+---
+- debug:
+    msg: START vyos_nat deleted full-match integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Delete destination rule 100 with full matching config
+      register: result
+      vyos.vyos.vyos_nat:
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 100
+                  description: Web server NAT
+                  protocol: tcp
+                  log: true
+                  inbound_interface:
+                    name: eth2
+                  destination:
+                    address: 198.51.100.10
+                    port: "80"
+                  translation:
+                    address: 192.168.1.10
+                    port: "8080"
+        state: deleted
+
+    - assert:
+        that:
+          - result.changed == true
+          - result.commands == ["delete nat destination rule 100"]
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: nat
+
+    - name: Assert rule 100 is actually gone from the device
+      assert:
+        that:
+          - ansible_facts['network_resources']['nat'].nat.destination is not defined or
+            ansible_facts['network_resources']['nat'].nat.destination.rule | default([]) | selectattr('id', 'equalto', 100) | list | length == 0
+
+    - name: Delete the same configuration again (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_nat:
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 100
+                  description: Web server NAT
+                  protocol: tcp
+                  log: true
+                  inbound_interface:
+                    name: eth2
+                  destination:
+                    address: 198.51.100.10
+                    port: "80"
+                  translation:
+                    address: 192.168.1.10
+                    port: "8080"
+        state: deleted
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/empty_config.yaml b/tests/integration/targets/vyos_nat/tests/cli/empty_config.yaml
new file mode 100644
index 00000000..39b57fee
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/empty_config.yaml
@@ -0,0 +1,60 @@
+---
+- debug:
+    msg: START vyos_nat empty_config integration tests on connection={{ ansible_connection }}
+
+- name: Merged with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_nat:
+    config:
+    state: merged
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state merged'
+
+- name: Replaced with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_nat:
+    config:
+    state: replaced
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state replaced'
+
+- name: Overridden with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_nat:
+    config:
+    state: overridden
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state overridden'
+
+- name: Parsed with empty running_config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_nat:
+    running_config:
+    state: parsed
+
+- assert:
+    that:
+      - result.msg == 'value of running_config parameter must not be empty for state parsed'
+
+- name: Rendered with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_nat:
+    config:
+    state: rendered
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state rendered'
+
+- include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/gathered.yaml b/tests/integration/targets/vyos_nat/tests/cli/gathered.yaml
new file mode 100644
index 00000000..a91410b8
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/gathered.yaml
@@ -0,0 +1,22 @@
+---
+- debug:
+    msg: START vyos_nat gathered integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Gather NAT config from the device
+      register: result
+      vyos.vyos.vyos_nat:
+        state: gathered
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: nat
+
+    - assert:
+        that:
+          - result.changed == false
+          - result.gathered|symmetric_difference(ansible_facts['network_resources']['nat']) == []
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/merged.yaml b/tests/integration/targets/vyos_nat/tests/cli/merged.yaml
new file mode 100644
index 00000000..73184fb6
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/merged.yaml
@@ -0,0 +1,110 @@
+---
+- debug:
+    msg: START vyos_nat merged integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Merge new NAT rule with existing configuration
+      register: result
+      vyos.vyos.vyos_nat: &id001
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 101
+                  description: New DNAT rule
+                  protocol: tcp
+                  destination:
+                    address: 198.51.100.11
+                    port: "443"
+                  translation:
+                    address: 192.168.1.11
+                    port: "8443"
+        state: merged
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: nat
+
+    - assert:
+        that:
+          - result.changed == true
+          - result.commands|symmetric_difference(merged.commands) == []
+          - result.after|symmetric_difference(ansible_facts['network_resources']['nat']) == []
+
+    - name: Assert that before dicts were correctly generated
+      assert:
+        that:
+          - merged['before'] | symmetric_difference(result['before']) | length == 0
+
+    - name: Merge the provided configuration with the existing running configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_nat: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+
+    - name: Add static rule with plain inbound_interface string
+      register: result
+      vyos.vyos.vyos_nat: &id002
+        config:
+          nat:
+            static:
+              rule:
+                - id: 300
+                  description: Static mapping
+                  inbound_interface: eth2
+                  destination:
+                    address: 192.168.100.20
+                  translation:
+                    address: 192.168.1.20
+        state: merged
+
+    - assert:
+        that:
+          - result.changed == true
+          - "'set nat static rule 300 inbound-interface eth2' in result.commands"
+
+    - name: Add static rule again (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_nat: *id002
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+
+    - name: Change static rule inbound_interface
+      register: result
+      vyos.vyos.vyos_nat: &id003
+        config:
+          nat:
+            static:
+              rule:
+                - id: 300
+                  description: Static mapping
+                  inbound_interface: eth3
+                  destination:
+                    address: 192.168.100.20
+                  translation:
+                    address: 192.168.1.20
+        state: merged
+
+    - assert:
+        that:
+          - result.changed == true
+          - result.commands == ["set nat static rule 300 inbound-interface eth3"]
+
+    - name: Change static rule inbound_interface again (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_nat: *id003
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/merged_load_balance.yaml b/tests/integration/targets/vyos_nat/tests/cli/merged_load_balance.yaml
new file mode 100644
index 00000000..04ee5816
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/merged_load_balance.yaml
@@ -0,0 +1,107 @@
+---
+- debug:
+    msg: START vyos_nat load balance integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Add destination rule with load-balance hash and backends
+      register: result
+      vyos.vyos.vyos_nat: &id001
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 105
+                  protocol: tcp
+                  destination:
+                    port: "80"
+                  inbound_interface:
+                    name: eth0
+                  load_balance:
+                    hash:
+                      - source-address
+                      - destination-address
+                    backend:
+                      - ip: 10.10.10.1
+                        weight: 60
+                      - ip: 10.10.10.2
+                        weight: 40
+        state: merged
+
+    - assert:
+        that:
+          - result.changed == true
+          - "'set nat destination rule 105 load-balance hash source-address' in result.commands"
+          - "'set nat destination rule 105 load-balance hash destination-address' in result.commands"
+          - "'set nat destination rule 105 load-balance backend 10.10.10.1 weight 60' in result.commands"
+          - "'set nat destination rule 105 load-balance backend 10.10.10.2 weight 40' in result.commands"
+
+    - name: Re-apply same load-balance config (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_nat: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+
+    - name: Change backend weights only (in-place overwrite check)
+      register: result
+      vyos.vyos.vyos_nat: &id002
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 105
+                  protocol: tcp
+                  destination:
+                    port: "80"
+                  inbound_interface:
+                    name: eth0
+                  load_balance:
+                    hash:
+                      - source-address
+                      - destination-address
+                    backend:
+                      - ip: 10.10.10.1
+                        weight: 70
+                      - ip: 10.10.10.2
+                        weight: 30
+        state: merged
+
+    - assert:
+        that:
+          - result.changed == true
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: nat
+
+    - name: Extract rule 105 from gathered facts
+      set_fact:
+        rule_105: "{{ ansible_facts['network_resources']['nat'].nat.destination.rule | selectattr('id', 'equalto', 105) | first }}"
+
+    - name: Extract backend weights from rule 105
+      set_fact:
+        backend_105: "{{ rule_105.load_balance.backend }}"
+        weight_101: "{{ (rule_105.load_balance.backend | selectattr('ip', 'equalto', '10.10.10.1') | first).weight }}"
+        weight_102: "{{ (rule_105.load_balance.backend | selectattr('ip', 'equalto', '10.10.10.2') | first).weight }}"
+
+    - name: Assert weights updated and no duplicate/stale backend entries
+      assert:
+        that:
+          - backend_105 | length == 2
+          - weight_101 == 70
+          - weight_102 == 30
+
+    - name: Re-apply changed weights again (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_nat: *id002
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/overridden.yaml b/tests/integration/targets/vyos_nat/tests/cli/overridden.yaml
new file mode 100644
index 00000000..fbb87d72
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/overridden.yaml
@@ -0,0 +1,45 @@
+---
+- debug:
+    msg: START vyos_nat overridden integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Override NAT configuration
+      register: result
+      vyos.vyos.vyos_nat: &id001
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 100
+                  description: Overridden DNAT rule
+                  protocol: tcp
+                  destination:
+                    address: 198.51.100.20
+                    port: "443"
+                  translation:
+                    address: 192.168.1.20
+                    port: "8443"
+        state: overridden
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: nat
+
+    - assert:
+        that:
+          - result.changed == true
+          - result.commands|symmetric_difference(overridden.commands) == []
+          - result.after|symmetric_difference(ansible_facts['network_resources']['nat']) == []
+
+    - name: Override the existing configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_nat: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/parsed.yaml b/tests/integration/targets/vyos_nat/tests/cli/parsed.yaml
new file mode 100644
index 00000000..13a54f42
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/parsed.yaml
@@ -0,0 +1,16 @@
+---
+- debug:
+    msg: START vyos_nat parsed integration tests on connection={{ ansible_connection }}
+
+- name: Parse NAT configuration from file
+  register: result
+  vyos.vyos.vyos_nat:
+    running_config: "{{ lookup('file', '_parsed.cfg') }}"
+    state: parsed
+
+- assert:
+    that:
+      - result.changed == false
+      - result.parsed|symmetric_difference(merged.before) == []
+
+- include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/rendered.yaml b/tests/integration/targets/vyos_nat/tests/cli/rendered.yaml
new file mode 100644
index 00000000..9c7a8ccb
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/rendered.yaml
@@ -0,0 +1,32 @@
+---
+- debug:
+    msg: START vyos_nat rendered integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _remove_config.yaml
+
+- block:
+    - name: Render NAT configuration without applying to device
+      register: result
+      vyos.vyos.vyos_nat:
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 100
+                  description: Rendered rule
+                  protocol: tcp
+                  destination:
+                    address: 198.51.100.10
+                    port: "80"
+                  translation:
+                    address: 192.168.1.10
+                    port: "8080"
+        state: rendered
+
+    - assert:
+        that:
+          - result.changed == false
+          - result.rendered|symmetric_difference(rendered.commands) == []
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/replaced.yaml b/tests/integration/targets/vyos_nat/tests/cli/replaced.yaml
new file mode 100644
index 00000000..a327c623
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/replaced.yaml
@@ -0,0 +1,45 @@
+---
+- debug:
+    msg: START vyos_nat replaced integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Replace NAT destination rule 100
+      register: result
+      vyos.vyos.vyos_nat: &id001
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 100
+                  description: Replaced DNAT rule
+                  protocol: udp
+                  destination:
+                    address: 198.51.100.10
+                    port: "53"
+                  translation:
+                    address: 192.168.1.53
+                    port: "53"
+        state: replaced
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: nat
+
+    - assert:
+        that:
+          - result.changed == true
+          - result.commands|symmetric_difference(replaced.commands) == []
+          - result.after|symmetric_difference(ansible_facts['network_resources']['nat']) == []
+
+    - name: Replace the provided configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_nat: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/replaced_cgnat_pool.yaml b/tests/integration/targets/vyos_nat/tests/cli/replaced_cgnat_pool.yaml
new file mode 100644
index 00000000..77fc295b
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/replaced_cgnat_pool.yaml
@@ -0,0 +1,77 @@
+---
+- debug:
+    msg: START vyos_nat replaced cgnat pool integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Establish baseline CGNAT external pool
+      vyos.vyos.vyos_nat:
+        config:
+          nat:
+            cgnat:
+              log_allocation: true
+              pool:
+                external:
+                  - name: ext-pool-1
+                    external_port_range: "10000-20000"
+                    per_user_limit:
+                      port: "200"
+                    range:
+                      - value: 203.0.113.0/24
+                      - value: 203.1.113.1-203.1.113.60
+                        seq: "10"
+                internal:
+                  - name: int-pool-1
+                    range:
+                      - 10.0.0.0/24
+              rule:
+                - id: 1
+                  source:
+                    pool: int-pool-1
+                  translation:
+                    pool: ext-pool-1
+        state: merged
+
+    - name: Replace CGNAT pool changing only external_port_range
+      register: result
+      vyos.vyos.vyos_nat:
+        config:
+          nat:
+            cgnat:
+              log_allocation: true
+              pool:
+                external:
+                  - name: ext-pool-1
+                    external_port_range: "30000-40000"
+                    per_user_limit:
+                      port: "200"
+                    range:
+                      - value: 203.0.113.0/24
+                      - value: 203.1.113.1-203.1.113.60
+                        seq: "10"
+                internal:
+                  - name: int-pool-1
+                    range:
+                      - 10.0.0.0/24
+              rule:
+                - id: 1
+                  source:
+                    pool: int-pool-1
+                  translation:
+                    pool: ext-pool-1
+        state: replaced
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: nat
+
+    - name: Assert all pool fields survived the replace, not just the changed one
+      assert:
+        that:
+          - result.changed == true
+          - ansible_facts['network_resources']['nat'].nat.cgnat.pool.external[0].external_port_range == "30000-40000"
+          - ansible_facts['network_resources']['nat'].nat.cgnat.pool.external[0].per_user_limit.port == "200"
+          - ansible_facts['network_resources']['nat'].nat.cgnat.pool.external[0].range | length == 2
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/tests/cli/rtt.yaml b/tests/integration/targets/vyos_nat/tests/cli/rtt.yaml
new file mode 100644
index 00000000..8ec9397e
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/tests/cli/rtt.yaml
@@ -0,0 +1,70 @@
+---
+- debug:
+    msg: START vyos_nat round trip integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Apply additional NAT rule to establish base config
+      register: baseconfig
+      vyos.vyos.vyos_nat:
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 100
+                  description: Web server NAT
+                  protocol: tcp
+                  log: true
+                  inbound_interface:
+                    name: eth2
+                  destination:
+                    address: 198.51.100.10
+                    port: "80"
+                  translation:
+                    address: 192.168.1.10
+                    port: "8080"
+                - id: 101
+                  description: RTT base rule
+                  protocol: tcp
+                  destination:
+                    address: 198.51.100.11
+                    port: "443"
+                  translation:
+                    address: 192.168.1.11
+                    port: "8443"
+        state: merged
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: nat
+
+    - name: Modify rule 101 description
+      register: result
+      vyos.vyos.vyos_nat:
+        config:
+          nat:
+            destination:
+              rule:
+                - id: 101
+                  description: RTT modified rule
+                  protocol: tcp
+                  destination:
+                    address: 198.51.100.11
+                    port: "443"
+                  translation:
+                    address: 192.168.1.11
+                    port: "8443"
+        state: merged
+
+    - name: Revert back to base config using facts round trip
+      register: revert
+      vyos.vyos.vyos_nat:
+        config: "{{ ansible_facts['network_resources']['nat'] }}"
+        state: overridden
+
+    - name: Assert that config was reverted
+      assert:
+        that: baseconfig.after == revert.after
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_nat/vars/main.yaml b/tests/integration/targets/vyos_nat/vars/main.yaml
new file mode 100644
index 00000000..0bae2c03
--- /dev/null
+++ b/tests/integration/targets/vyos_nat/vars/main.yaml
@@ -0,0 +1,172 @@
+---
+populate_config:
+  - set nat destination rule 100 description 'Web server NAT'
+  - set nat destination rule 100 destination address '198.51.100.10'
+  - set nat destination rule 100 destination port '80'
+  - set nat destination rule 100 inbound-interface name 'eth2'
+  - set nat destination rule 100 log
+  - set nat destination rule 100 protocol 'tcp'
+  - set nat destination rule 100 translation address '192.168.1.10'
+  - set nat destination rule 100 translation port '8080'
+  - set nat source rule 200 description 'Outbound NAT'
+  - set nat source rule 200 destination address '192.168.10.100'
+  - set nat source rule 200 destination port '8083'
+  - set nat source rule 200 disable
+  - set nat source rule 200 exclude
+  - set nat source rule 200 log
+  - set nat source rule 200 protocol 'tcp'
+  - set nat source rule 200 translation address 'masquerade'
+  - set nat source rule 200 translation port '443'
+
+merged:
+  before:
+    nat:
+      destination:
+        rule:
+          - id: 100
+            description: Web server NAT
+            protocol: tcp
+            log: true
+            inbound_interface:
+              name: eth2
+            destination:
+              address: 198.51.100.10
+              port: "80"
+            translation:
+              address: 192.168.1.10
+              port: "8080"
+      source:
+        rule:
+          - id: 200
+            description: Outbound NAT
+            protocol: tcp
+            log: true
+            disable: true
+            exclude: true
+            destination:
+              address: 192.168.10.100
+              port: "8083"
+            translation:
+              address: masquerade
+              port: "443"
+  commands:
+    - set nat destination rule 101 description 'New DNAT rule'
+    - set nat destination rule 101 protocol tcp
+    - set nat destination rule 101 destination address 198.51.100.11
+    - set nat destination rule 101 destination port 443
+    - set nat destination rule 101 translation address 192.168.1.11
+    - set nat destination rule 101 translation port 8443
+  after:
+    nat:
+      destination:
+        rule:
+          - id: 100
+            description: Web server NAT
+            protocol: tcp
+            log: true
+            inbound_interface:
+              name: eth2
+            destination:
+              address: 198.51.100.10
+              port: "80"
+            translation:
+              address: 192.168.1.10
+              port: "8080"
+          - id: 101
+            description: New DNAT rule
+            protocol: tcp
+            destination:
+              address: 198.51.100.11
+              port: "443"
+            translation:
+              address: 192.168.1.11
+              port: "8443"
+      source:
+        rule:
+          - id: 200
+            description: Outbound NAT
+            protocol: tcp
+            log: true
+            disable: true
+            exclude: true
+            destination:
+              address: 192.168.10.100
+              port: "8083"
+            translation:
+              address: masquerade
+              port: "443"
+
+replaced:
+  commands:
+    - delete nat destination rule 100
+    - set nat destination rule 100 description 'Replaced DNAT rule'
+    - set nat destination rule 100 protocol udp
+    - set nat destination rule 100 destination address 198.51.100.10
+    - set nat destination rule 100 destination port 53
+    - set nat destination rule 100 translation address 192.168.1.53
+    - set nat destination rule 100 translation port 53
+  after:
+    nat:
+      destination:
+        rule:
+          - id: 100
+            description: Replaced DNAT rule
+            protocol: udp
+            destination:
+              address: 198.51.100.10
+              port: "53"
+            translation:
+              address: 192.168.1.53
+              port: "53"
+      source:
+        rule:
+          - id: 200
+            description: Outbound NAT
+            protocol: tcp
+            log: true
+            disable: true
+            exclude: true
+            destination:
+              address: 192.168.10.100
+              port: "8083"
+            translation:
+              address: masquerade
+              port: "443"
+
+overridden:
+  commands:
+    - delete nat source
+    - delete nat destination rule 100
+    - set nat destination rule 100 description 'Overridden DNAT rule'
+    - set nat destination rule 100 protocol tcp
+    - set nat destination rule 100 destination address 198.51.100.20
+    - set nat destination rule 100 destination port 443
+    - set nat destination rule 100 translation address 192.168.1.20
+    - set nat destination rule 100 translation port 8443
+  after:
+    nat:
+      destination:
+        rule:
+          - id: 100
+            description: Overridden DNAT rule
+            protocol: tcp
+            destination:
+              address: 198.51.100.20
+              port: "443"
+            translation:
+              address: 192.168.1.20
+              port: "8443"
+
+deleted:
+  commands:
+    - delete nat
+  after: {}
+
+rendered:
+  commands:
+    - set nat destination rule 100 description 'Rendered rule'
+    - set nat destination rule 100 protocol tcp
+    - set nat destination rule 100 destination address 198.51.100.10
+    - set nat destination rule 100 destination port 80
+    - set nat destination rule 100 translation address 192.168.1.10
+    - set nat destination rule 100 translation port 8080