1

I am running my OpenWrt Router as an OpenVPN Client in a VPN site-to-site setup. After Upgrading to newest OpenWrt 22.03 I have to migrate my firewall coustom rules to nftables. Can you help me finding the nft-file for this:

  • /usr/sbin/iptables -t nat -I PREROUTING -i tun+ -d 10.2.1.0/24 -j NETMAP --to 192.168.1.0/24
  • /usr/sbin/iptables -t nat -I POSTROUTING -o tun+ -s 192.168.1.0/24 -j NETMAP --to 10.2.1.0/24

Con you help? This is not working:

table ip nat {
    chain prerouting {
        type filter hook prerouting priority 0; policy accept;
        ip saddr 10.2.1.0/24 dnat 192.168.1.0/24
    }

    chain postrouting {
        type filter hook postrouting priority 100; policy accept;
        ip saddr 192.168.1.0/24 snat 10.2.1.0/24
    }
}
dex.404
  • 21
  • 3

1 Answers1

0

The example you provided I believe does NAT pooling (I think that is the correct term), instead of 1:1 nat. This makes an input .1 address end up with a random .0-.255 destination ip for a /24 block.

This works for me:

  1. ensure firewall allows access to the zone(s) you are trying to access. For example something like this:
config forwarding
        option src 'vpn'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'vpn'
  1. add the following to /etc/config/firewall
config include
        option type 'nftables'
        option path '/etc/firewall_1to1_nat.nft'
        option position 'ruleset-post'
  1. create /etc/firewall_1to1_nat.nft - this will translate inbound 10.11.0.0/24 to 192.168.0.0/24 and back.
table ip NAT1to1
delete table ip NAT1to1
table ip NAT1to1 {
        chain dstnat {
                type nat hook prerouting priority dstnat; policy accept;
                ip daddr 10.11.0.0/24 iif WIREGUARD counter meta nftrace set 1 dnat ip prefix to ip daddr map { 10.11.0.0/24 : 192.168.0.0/24 }
        }
 
        chain srcnat {
                type nat hook postrouting priority srcnat; policy accept;
                ip saddr 192.168.0.0/24 oif WIREGUARD counter meta nftrace set 1 snat ip prefix to ip saddr map { 192.168.0.0/24 : 10.11.0.0/24 }
        }
}

Note: remove the counter and meta nftrace set 1 bits as needed.

Note: this works on ip type nftables but not the inet type. inet tables end with an Error: Could not process rule: Not supported message.

Note: for wireguard, the remote end will need to have 10.11.0.0/24 in allowed IPs for this example.

Source: https://git.netfilter.org/nftables/commit/?id=35a6b10c1bc488ca195e9c641563c29251f725f3

  1. Also do not forget to update /etc/sysupgrade.conf so your backups also contain the updated file.
/etc/firewall_defray_1to1_nat.nft

edit: corrected error; you cannot flush a table

ykuksenko
  • 399
  • 3
  • 4