TC-NAT(8)

💖 NAT action in tc(8) 💖

Okay bestie, this is the page for the nat action in tc(8). Its whole name is nat - stateless native address translation action 🦋 It's the NAT action that goes in tc, and it's stateless, which means it doesn't keep track of connections.

✨ NAME ✨

nat - stateless native address translation action 🎀

🌸 SYNOPSIS 🌸

tc ... action nat DIRECTION OLD NEW

DIRECTION := { ingress | egress }

OLD := IPV4_ADDR_SPEC

NEW := IPV4_ADDR_SPEC

IPV4_ADDR_SPEC := { default | any | all | in_addr[/{prefix|netmask}]

🧚 DESCRIPTION 🧚

Okay so the nat action lets you do NAT without the overhead of conntrack 🙈 That's super useful when you've got a huge number of flows or addresses to translate, bestie. Like, it's giving efficiency. 💅 It works best when you pair it with the u32 filter, because then you can look up a big pile of stateless NAT rules in constant time. Iconic. 🔥

🍓 OPTIONS 🍓

• ingress — Translates destination addresses, aka DNAT 💜
• egress — Translates source addresses, aka SNAT ✨
• OLD — Says which addresses should get translated 🌈
• NEW — Says which addresses OLD should be translated into 🦋

💅 NOTES 💅

The address format for OLD and NEW is seriously flexible, no cap 🫶 You can use one of the keywords default, any or all, which all mean the all-zero IP address. Or you can do an IP address plus a netmask or prefix length, separated by a slash (/). Either way, the mask (or prefix length) from OLD gets used for NEW too, so you always get a one-to-one mapping of addresses. Periodt. 💖

Address translation is done with a combo of binary operations 🧠 First, the original address (source or destination) gets matched against OLD. If it fits, the new address is built by taking the leading bits from NEW (defined by the netmask of OLD) and taking the remaining bits from the original address. It's giving math magic. ✨

Heads up: there's only rudimental support for upper layer protocols, namely TCP, UDP and ICMP 😭 For TCP and UDP, the action only recalculates the checksum. For ICMP, it also takes care of embedded IP headers inside ICMP packets and translates the addresses in there too. 🙈

🦋 SEE ALSO 🦋

tc(8) 💜

Bye bestie, that's the whole page! 🫶 This one's from the iproute2 package, dated 12 Jan 2015, and it's filed under NAT action in tc(8) 💖✨