Page MenuHomeVyOS Platform

NAT - Error on setting up tables
Closed, ResolvedPublicBUG

Description

On latest 1.4 releases, after a fresh install, this is the content of NAT table:

# pre-nat
[email protected]:~$ sudo nft list table ip nat
table ip nat {
	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		counter packets 0 bytes 0 jump VYOS_PRE_DNAT_HOOK
	}

	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
		counter packets 30 bytes 1800 jump VYOS_PRE_SNAT_HOOK
	}

	chain VYOS_PRE_DNAT_HOOK {
		return
	}

	chain VYOS_PRE_SNAT_HOOK {
		return
	}
}

There we can see both jumps from PREROUTING and POSTROUTING to VYOS_PRE_XNAT_HOOK. Also, return action present at chains VYOS_PRE_XNAT_HOOK

But, after adding, for example a simple nat source rule, we get:

table ip nat {
	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
	}

	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "eth0" ip saddr 192.168.99.0/24 counter packets 0 bytes 0 masquerade comment "SRC-NAT-10"
	}

	chain VYOS_PRE_DNAT_HOOK {
	}

	chain VYOS_PRE_SNAT_HOOK {
	}
}

No jumps to VYOS_PRE_XNAT_HOOK present on PRE and POST routing chains. Also, no return action on VYOS_PRE_XNAT_HOOKs

This leads to misbehavior of other components, such as WAN Load Balance. Some entries on the forum:

Bugs related to this main cause:

Details

Difficulty level
Unknown (require assessment)
Version
vyos-1.4-rolling-202204130521
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

Review code: https://github.com/vyos/vyos-1x/blob/current/data/templates/firewall/nftables-nat.tmpl#L141-L142

Issues found if flushing all nat table:

  • It removes nat entries written by other modules, such as wan load balacing

Issues found in the process of setting up tables (https://github.com/vyos/vyos-1x/blob/current/data/templates/firewall/nftables-nat.tmpl#L165-L179):

  • No jumps from PRE-POST-ROUTING to VYOS_PRE_xNAT_HOOK
  • No return actions on such hooks.
n.fort changed the task status from Open to Needs testing.Apr 22 2022, 5:31 PM