nftables compatibility
Hi,
while playing with nftables, i observe that my iptables masquerading do not work anymore:
modprobe nft_nat
modprobe nft_chain_nat_ipv4
nft add table nat
nft add chain nat postrouting { type nat hook postrouting priority 0 \; }
^^ iptables nat stoped work here.
I'm sure i read that nftables and iptables where compatible.
Can anyone point me what am i missing ?
(I'm on 3.17.4)
Best regards.
Hi,
Quoted 10 lines · Jean-Philippe Menil
Hi,
while playing with nftables, i observe that my iptables masquerading do not work anymore:
modprobe
nft_nat
modprobenft_chain_nat_ipv4
nft add table nat
nft add chain nat postrouting { type nat hook postrouting priority 0 \; }
Quoted 7 lines
^^ iptables nat stoped work here.
I'm sure i read that nftables and iptables where compatible.
Can anyone point me what am i missing ?
(I'm on 3.17.4)
Sadly, masquerade is requiring 3.18. Only standard NAT is implemented in 3.17.x.
BR,
Signature · 1 line
Eric Leblond <[email protected]>
Quoted 17 lines · Eric Leblond
Hi,
Quoted 14 lines · Jean-Philippe Menil
Hi,
while playing with nftables, i observe that my iptables masquerading do not work anymore:
modprobe
nft_nat
modprobenft_chain_nat_ipv4
nft add table nat
nft add chain nat postrouting { type nat hook postrouting priority 0 \; }^^ iptables nat stoped work here.
I'm sure i read that nftables and iptables where compatible.
Quoted 9 lines
Quoted 3 lines
Can anyone point me what am i missing ?
(I'm on 3.17.4)
Sadly, masquerade is requiring 3.18. Only standard NAT is implemented in 3.17.x.
BR,
Hi Eric,
thanks for your response.
I've see on the wiki that masquerading require a 3.18 kernel.
But why juste adding the type nat hook with nftables, broke the iptables masquerading?
There's no problem at all, i will upgrade to 3.18 for my tests.
Best regards.
Quoted 6 lines · Jean-Philippe Menil
Quoted 5 lines · Eric Leblond
Hi,
Quoted 2 lines · Jean-Philippe Menil
Hi,
Quoted 7 lines
Quoted 7 lines
Quoted 7 lines
while playing with nftables, i observe that my iptables masquerading do not work anymore:
modprobe
nft_nat
modprobenft_chain_nat_ipv4
nft add table nat
nft add chain nat postrouting { type nat hook postrouting priority 0 \; }
BTW, you will also have to add the prerouting nat chain so the NAT engine can undo NAT for reply traffic, see:
http://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_%28NAT%29
Quoted 13 lines
Quoted 4 lines
Quoted 4 lines
^^ iptables nat stoped work here.
I'm sure i read that nftables and iptables where compatible.
Quoted 9 lines
Quoted 3 lines
Can anyone point me what am i missing ?
(I'm on 3.17.4)
Sadly, masquerade is requiring 3.18. Only standard NAT is implemented in 3.17.x.
BR,
Quoted 8 lines
Hi Eric,
thanks for your response.
I've see on the wiki that masquerading require a 3.18 kernel.
But why juste adding the type nat hook with nftables, broke the iptables masquerading?
Because the NAT engine attaches the nul-nat-binding (ie. this conntrack has no nat at all) when the packet leaves the chain without matching any rule.
If you run iptables and nf_tables for NAT at the same time, the first chain will configure NAT for the conntrack, the second will just skip the packet since NAT has been already set up.
Quoted 1 line
There's no problem at all, i will upgrade to 3.18 for my tests.
Thanks.
Quoted 15 lines · Pablo Neira Ayuso
Quoted 6 lines · Jean-Philippe Menil
Quoted 5 lines · Eric Leblond
Hi,
Quoted 2 lines · Jean-Philippe Menil
Hi,
Quoted 7 lines
Quoted 7 lines
Quoted 7 lines
while playing with nftables, i observe that my iptables masquerading do not work anymore:
modprobe
nft_nat
modprobenft_chain_nat_ipv4
nft add table nat
nft add chain nat postrouting { type nat hook postrouting priority 0 \; }
Quoted 4 lines
BTW, you will also have to add the prerouting nat chain so the NAT engine can undo NAT for reply traffic, see:
http://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_%28NAT%29
Yes, i just forget to pas in the mail :)
Quoted 23 lines
Quoted 14 lines
Quoted 5 lines
Quoted 5 lines
^^ iptables nat stoped work here.
I'm sure i read that nftables and iptables where compatible.
Quoted 9 lines
Quoted 3 lines
Can anyone point me what am i missing ?
(I'm on 3.17.4)
Sadly, masquerade is requiring 3.18. Only standard NAT is implemented in 3.17.x.
BR,
Quoted 8 lines
Hi Eric,
thanks for your response.
I've see on the wiki that masquerading require a 3.18 kernel.
But why juste adding the type nat hook with nftables, broke the iptables masquerading?
Quoted 7 lines
Because the NAT engine attaches the nul-nat-binding (ie. this conntrack has no nat at all) when the packet leaves the chain without matching any rule.
If you run iptables and
nf_tablesfor NAT at the same time, the first chain will configure NAT for the conntrack, the second will just skip the packet since NAT has been already set up.
Ok, now i understand better.
Many thanks !