Page MenuHomeVyOS Platform

Implement "--persistent" option to NAT rules
Open, NormalPublicFEATURE REQUEST

Description

Hello!
We need to add ability to set "--persistent" flag to NAT rules. Without it correct NAT to range of IP address often is not possible, because different connections from/to same client NATed to different IP addresses.

--persistent
Gives a client the same source-/destination-address for each connection. This supersedes the SAME target. Support for persistent mappings is available from 2.6.29-rc2.

Details

Difficulty level
Unknown (require assessment)
Version
-
Why the issue appeared?
Will be filled on close

Event Timeline

zsdc created this task.Dec 5 2018, 9:27 AM
syncer triaged this task as Normal priority.Dec 6 2018, 12:02 AM
syncer edited projects, added VyOS 1.3 Equuleus; removed VyOS 1.2 Crux.
pasik added a subscriber: pasik.Mar 12 2019, 6:08 PM
hard added a subscriber: hard.Sep 20 2019, 9:15 PM
hard added a comment.Sep 21 2019, 6:33 PM

Almost done, also implemented 'random' flag, looks ok? or change name? for example - flag, or flags

random: randomize source port mapping.

description main
nat-flags {
   persistent
   random
}
outbound-interface bond1
source {
    address 0.0.0.0/0
}
translation {
    address 10.10.10.5-10.10.10.20
}
hard added a comment.Sep 21 2019, 8:37 PM

Created pull request

Viacheslav added a comment.EditedMar 14 2020, 3:07 PM

https://github.com/vyos/vyatta-nat/blob/current/scripts/vyatta-update-src-nat.pl#L159

Can we add checks?

set nat source rule 10 translation address 1.1.1.50-1.1.120 persistent

If string contain "persistent" or node set to persistent; then

$cmd = "$IPTABLES -t nat -I $chain_name $ipt_rulenum " ."$rule_str" --persistent;

I don't know how it do with perl, it their documentations it's function names "index, rindex"
index - find a substring within a string
rindex - right-to-left substring search

It would be great if someone writes this check.