Page MenuHomeVyOS Platform

Destination NAT fails to commit
Closed, ResolvedPublicBUG

Description

If source NAT configuration exists, subsequent destination NAT configuration fails to commit:

 nat {
+    destination {
+        rule 100 {
+            destination {
+                port 22
+            }
+            inbound-interface eth1
+            protocol tcp
+            translation {
+                address 192.168.1.4
+            }
+        }
+    }
     source {
         rule 100 {
             outbound-interface eth0
             translation {
                 address masquerade
             }
         }
     }
 }

admin@gw@# commit
[ nat ]
VyOS had an issue completing a command.

.
.
.

Report Time:      2020-12-01 15:40:30
Image Version:    VyOS 1.3-rolling-202012010217
Release Train:    equuleus

Built by:         autobuild@vyos.net
Built on:         Tue 01 Dec 2020 02:17 UTC
Build UUID:       51f63067-cf03-4678-ad9b-907ba1b1170f
Build Commit ID:  65ebf0e2c4113c

Architecture:     x86_64
Boot via:         installed image
System type:      KVM guest

Hardware vendor:  QEMU
Hardware model:   Standard PC (i440FX + PIIX, 1996)
Hardware S/N:     
Hardware UUID:    510e9de4-a940-4b9c-b61a-9e996b5c7f67

Traceback (most recent call last):
  File "/usr/libexec/vyos/conf_mode/nat.py", line 199, in <module>
    verify(c)
  File "/usr/libexec/vyos/conf_mode/nat.py", line 133, in verify
    if nat['helper_functions']:
KeyError: 'helper_functions'



[[nat]] failed
Commit failed

Details

Difficulty level
Easy (less than an hour)
Version
VyOS 1.3-rolling-202012010217
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)

Event Timeline

c-po changed the task status from In progress to Needs testing.Dec 1 2020, 9:58 PM
c-po triaged this task as High priority.
c-po changed Difficulty level from Unknown (require assessment) to Easy (less than an hour).

Thank you @Dmitry, it will be in tomorrows rolling release.

table ip nat {
        chain PREROUTING {
                type nat hook prerouting priority dstnat; policy accept;
                iifname "eth1" tcp dport { 22 } counter packets 0 bytes 0 dnat to 192.168.1.4 comment "DST-NAT-100"
        }
}

rule is now installed, it was a refactoring error on my side.