Stop Broken LAN Port Forwards: Practical nftables SNAT, DNAT, Masquerade, and Hairpin NAT

Description and use

Proper nftables NAT configuration enables LAN clients to use the public IP and keeps outbound traffic functional after WAN IP changes. Includes masquerade, snat, dnat, redirect, and hairpin SNAT with dedicated chains and maps.

Problem

LAN clients cannot reach services via public hostname/IP due to incomplete NAT; outbound traffic fails when WAN IP changes; hard‑coded SNAT rules break.

Outcome

LAN clients can now use public hostname/IP; outbound traffic remains functional after ISP IP changes; NAT rules are stateful, persistent, and easier to maintain with maps.

Workflow

• Enable IPv4 forwarding with sysctl and persist it
• Create nat table with postrouting chain for SNAT/masquerade and prerouting chain for DNAT
• Add masquerade rule for dynamic WAN or snat rule for static WAN
• Add dnat rule on prerouting for inbound services and corresponding forward filter rule
• Use redirect for local port rewrites if needed
• Create maps to collapse multiple dnat rules into single statements
• Add hairpin SNAT rule to translate source back to public IP for LAN clients
• Verify rules with nft list ruleset and test connectivity
• Persist rules in /etc/nftables.d/ and enable nftables service
• Rollback by restoring previous ruleset if issues arise

Evidence

Use dedicated NAT base chains on the right hooks and priorities

Source