Stop Broken LAN Port Forwards: Practical nftables SNAT, DNAT, Masquerade, and Hairpin NAT

Описание и применение

Правильная настройка nftables NAT позволяет клиентам LAN использовать публичный IP, а исходящий трафик остаётся доступным после смены WAN‑адреса. Включены masquerade, snat, dnat, redirect и hairpin SNAT с использованием специализированных цепочек и карт.

Задача

LAN clients cannot reach services via public hostname/IP due to incomplete NAT; outbound traffic fails when WAN IP changes; hard‑coded SNAT rules break.

Результат

LAN clients can now use public hostname/IP; outbound traffic remains functional after ISP IP changes; NAT rules are stateful, persistent, and easier to maintain with maps.

Рабочий процесс

• Enable IPv4 forwarding with sysctl and persist it
• Create nat table with postrouting chain for SNAT/masquerade and prerouting chain for DNAT
• Add masquerade rule for dynamic WAN or snat rule for static WAN
• Add dnat rule on prerouting for inbound services and corresponding forward filter rule
• Use redirect for local port rewrites if needed
• Create maps to collapse multiple dnat rules into single statements
• Add hairpin SNAT rule to translate source back to public IP for LAN clients
• Verify rules with nft list ruleset and test connectivity
• Persist rules in /etc/nftables.d/ and enable nftables service
• Rollback by restoring previous ruleset if issues arise

Доказательства

Use dedicated NAT base chains on the right hooks and priorities

Источник