search

google / nftables

This repository contains a Go module to interact with Linux nftables (the iptables successor).
Apache License 2.0
1.12k stars 140 forks source link

nat: Add flag for specified range in DNAT #270

Closed a-ilin closed 3 months ago

a-ilin commented 3 months ago

The current implementation of NAT lacks the flag for specified ranges: https://github.com/torvalds/linux/blob/master/net/netfilter/nf_nat_core.c#L525

Example nft command: meta l4proto tcp dnat to 10.200.45.6:9080

  [ meta load l4proto => reg 1 ]
  [ cmp eq reg 1 0x00000006 ]
  [ immediate reg 1 0x062dc80a ]
  [ immediate reg 2 0x00007823 ]
  [ nat dnat ip addr_min reg 1 proto_min reg 2 flags 0x2 ]

This PR adds specified ranges parameter in NAT.