nf_nat_used_tuple(9)

💅 nf_nat_used_tuple(9) 💅

okay so bestie, welcome to the kernel API manual ✨ this one's a function from the Kernel API Manual, and it's lowkey one of those tiny functions that does SO much heavy lifting. let's get into it 🫶

---

🌸 NAME 🌸

nf_nat_used_tuple — literally checks if your proposed nat tuple is gonna clash with an existing entry 💀

---

✨ SYNOPSIS ✨

int nf_nat_used_tuple (const struct nf_conntrack_tuple *tuple , const struct nf_conn *ignored_conntrack );

that's it. two args, one int back. she's simple, she's iconic 👑

---

🎀 ARGUMENTS 🎀

• tuple — the proposed NAT binding, aka the thing we're tryna see if it's valid. main character of the question ngl 💅
• ignored_conntrack — our own (unconfirmed) conntrack entry. yeah she's tagged "ignored" but she still matters, don't do her dirty 🙈

---

🦋 DESCRIPTION 🦋

so here's the vibe check: a conntrack entry can only be inserted into the connection tracking table if there's no existing entry with an identical tuple in either direction. either direction, bestie. both ways. no cap 🚨

that's the whole thing. that's the function. she checks, you decide. periodt.

---

🔥 EXAMPLE 🔥

here's the scenario, and honestly it's giving "this is why we can't have nice things" 😭

INITIATOR -> NAT/PAT -> RESPONDER

so INITIATOR passes through NAT/PAT (that's "us", hi 👋) and SNAT is done (saddr rewrite). then, later, NAT/PAT itself also connects to RESPONDER.

and this will not work if the SNAT done earlier has the same IP:PORT source pair 💀

the conntrack table has:

ORIGINAL: $IP_INITIATOR:$SPORT -> $IP_RESPONDER:$DPORT
REPLY:    $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT

and the new locally originating connection wants:

ORIGINAL: $IP_NAT:$SPORT -> $IP_RESPONDER:$DPORT
REPLY:    $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT

… which would mean incoming packets can't be distinguished between the existing entry and the newly added one, because they'd have an identical IP_CT_DIR_REPLY tuple 😭😭 identical!! the packets would be out here matching two entries and nobody would know which is which. chaos. mess. disaster. prevent it. 🫶

---

⭐ RETURN ⭐

returns true if the proposed NAT mapping collides with an existing entry. that's your red flag bestie, listen to it 🚩

---

🌈 SEE ALSO 🌈

• Kernel file ./net/netfilter/nf_nat_core.c
• nf_nat_used_tuple_new(9)

---

and that's the tea! 🍓 this page came from ./net/netfilter, dated October 2026 — so go forth and check those tuples, queen. you got this 💜✨🎀