Documentation
VyOS Documentation
NAT in VyOS
NAT (Network Address Translation)

NAT (Network Address Translation)

Network Address Translation (NAT) remaps IP address space by modifying the network address information in the headers of IP packets as they pass through a router.

Overview

NAT lets you:

  • Conserve public IPv4 addresses
  • Connect many devices to the internet through a single public IP
  • Hide the internal structure of your network
  • Provide access to internal services from the internet (port forwarding)

Private address spaces (RFC 1918)

  • 10.0.0.0/8 - 16,777,216 addresses
  • 172.16.0.0/12 - 1,048,576 addresses
  • 192.168.0.0/16 - 65,536 addresses

NAT types

Source NAT (SNAT)

Changes the source address of a packet. Used to give internal hosts access to the internet.

Basic SNAT with masquerade:

set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.0.0/24'
set nat source rule 100 translation address 'masquerade'

SNAT with a specific IP:

set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.0.0/24'
set nat source rule 100 translation address '203.0.113.10'

Destination NAT (DNAT)

Changes the destination address of a packet. Used for port forwarding and to expose internal services externally.

Port forwarding:

set nat destination rule 10 description 'Port Forward: HTTP to Web Server'
set nat destination rule 10 destination port '80'
set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '192.168.0.100'

Changing the port during forwarding:

set nat destination rule 20 description 'SSH on custom port 2222 to 192.168.0.10:22'
set nat destination rule 20 destination port '2222'
set nat destination rule 20 inbound-interface name 'eth0'
set nat destination rule 20 protocol 'tcp'
set nat destination rule 20 translation address '192.168.0.10'
set nat destination rule 20 translation port '22'

1:1 NAT (Bidirectional NAT)

A static mapping of one public IP to one private IP in both directions.

# SNAT
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 source address '192.168.0.100'
set nat source rule 10 translation address '203.0.113.100'

# DNAT
set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 destination address '203.0.113.100'
set nat destination rule 10 translation address '192.168.0.100'

Structure of NAT rules

Source NAT

set nat source rule <number> description '<text>'
set nat source rule <number> outbound-interface name '<interface>'
set nat source rule <number> source address '<address/prefix>'
set nat source rule <number> source port '<port>'
set nat source rule <number> destination address '<address/prefix>'
set nat source rule <number> destination port '<port>'
set nat source rule <number> protocol '<protocol>'
set nat source rule <number> translation address '<address>|masquerade'
set nat source rule <number> translation port '<port>'

Destination NAT

set nat destination rule <number> description '<text>'
set nat destination rule <number> inbound-interface name '<interface>'
set nat destination rule <number> destination address '<address/prefix>'
set nat destination rule <number> destination port '<port>'
set nat destination rule <number> source address '<address/prefix>'
set nat destination rule <number> protocol '<protocol>'
set nat destination rule <number> translation address '<address>'
set nat destination rule <number> translation port '<port>'

Configuration parameters

Masquerade

Automatically uses the IP address of the outbound interface:

set nat source rule 100 translation address masquerade

Advantages:

  • Automatically adapts to interface IP changes
  • Ideal for DHCP WAN interfaces
  • No need to specify a particular IP

Disadvantages:

  • Slightly slower than static NAT
  • All connections drop when the interface IP changes

Exclude NAT

Excluding specific traffic from NAT:

set nat source rule 10 destination address '192.168.100.0/24'
set nat source rule 10 source address '192.168.0.0/24'
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 exclude

Load Balancing

Distributing load across several internal servers:

set nat destination rule 10 description 'Load balance HTTP traffic'
set nat destination rule 10 destination port '80'
set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '192.168.0.10-192.168.0.20'

Port Ranges

Port ranges:

set nat destination rule 10 destination port '8000-8100'
set nat destination rule 10 translation address '192.168.0.100'
set nat destination rule 10 translation port '8000-8100'

Configuration examples

Basic NAT for a home network

# Source NAT for internet access
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.1.0/24'
set nat source rule 100 translation address 'masquerade'

Web server behind NAT

# HTTP
set nat destination rule 10 description 'HTTP to Web Server'
set nat destination rule 10 destination port '80'
set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '192.168.0.100'

# HTTPS
set nat destination rule 20 description 'HTTPS to Web Server'
set nat destination rule 20 destination port '443'
set nat destination rule 20 inbound-interface name 'eth0'
set nat destination rule 20 protocol 'tcp'
set nat destination rule 20 translation address '192.168.0.100'

SSH on a non-standard port

set nat destination rule 30 description 'SSH on port 2222'
set nat destination rule 30 destination port '2222'
set nat destination rule 30 inbound-interface name 'eth0'
set nat destination rule 30 protocol 'tcp'
set nat destination rule 30 translation address '192.168.0.10'
set nat destination rule 30 translation port '22'

Multiple public IPs

# First subnet through the first IP
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.1.0/24'
set nat source rule 100 translation address '203.0.113.10'

# Second subnet through the second IP
set nat source rule 110 outbound-interface name 'eth0'
set nat source rule 110 source address '192.168.2.0/24'
set nat source rule 110 translation address '203.0.113.11'

DMZ with 1:1 NAT

# SNAT for the DMZ host
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 source address '192.168.100.10'
set nat source rule 10 translation address '203.0.113.100'

# DNAT for the DMZ host
set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 destination address '203.0.113.100'
set nat destination rule 10 translation address '192.168.100.10'

VPN and NAT

Excluding VPN traffic from NAT:

# Exclude VPN traffic
set nat source rule 10 description 'Exclude VPN from NAT'
set nat source rule 10 destination address '10.10.0.0/16'
set nat source rule 10 source address '192.168.0.0/24'
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 exclude

# NAT for the rest of the traffic
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.0.0/24'
set nat source rule 100 translation address 'masquerade'

Hairpin NAT (NAT Reflection)

Accessing an internal service from the internal network via its public IP:

# Regular DNAT for external access
set nat destination rule 10 description 'Web Server from Internet'
set nat destination rule 10 destination port '80'
set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '192.168.0.100'

# Hairpin NAT for internal access
set nat destination rule 11 description 'Web Server from LAN'
set nat destination rule 11 destination address '203.0.113.10'
set nat destination rule 11 destination port '80'
set nat destination rule 11 inbound-interface name 'eth1'
set nat destination rule 11 protocol 'tcp'
set nat destination rule 11 translation address '192.168.0.100'

set nat source rule 11 description 'Hairpin NAT for Web Server'
set nat source rule 11 destination address '192.168.0.100'
set nat source rule 11 destination port '80'
set nat source rule 11 outbound-interface name 'eth1'
set nat source rule 11 protocol 'tcp'
set nat source rule 11 translation address 'masquerade'

NAT64

Translation between IPv6 and IPv4. Lets IPv6 hosts reach IPv4 resources.

set nat64 source rule 100 source prefix '64:ff9b::/96'
set nat64 source rule 100 translation address '203.0.113.0/24'

NPTv6 (NAT66)

IPv6-to-IPv6 Network Prefix Translation for changing IPv6 prefixes.

set nat66 source rule 10 outbound-interface name 'eth0'
set nat66 source rule 10 source prefix '2001:db8:1::/48'
set nat66 source rule 10 translation prefix '2001:db8:2::/48'

Operational commands

Viewing NAT rules

Source NAT:

show nat source rules
show nat source statistics

Destination NAT:

show nat destination rules
show nat destination statistics

Viewing translations

show nat source translations
show nat destination translations

Connection table

show conntrack table ipv4

Clearing connections

All connections:

reset conntrack

A specific address:

reset conntrack source 192.168.0.10

Troubleshooting

Traffic is not passing through NAT

Check the NAT rules:

show nat source rules
show nat destination rules

Check the statistics:

show nat source statistics

Check the firewall rules:

show firewall

Port forwarding is not working

Check the DNAT rule:

show nat destination rules

Check the translations:

show nat destination translations

Check the firewall for the forward chain:

show firewall ipv4 forward filter

Make sure IP forwarding is enabled (it is enabled by default in VyOS).

Hairpin NAT issues

Make sure both rules are configured:

  1. DNAT for incoming traffic from the LAN
  2. SNAT for the return traffic

Check the routing:

show ip route

Connection tracking is full

Check the number of connections:

show conntrack table ipv4 | wc -l

Increase the limit (if necessary):

set system conntrack table-size 262144

Best practices

  1. Rule numbering - use gaps (10, 20, 30) to allow for future insertions
  2. Use descriptions - document the purpose of each rule
  3. Exclude before NAT - exclude rules should have lower numbers
  4. Test incrementally - add rules in stages
  5. Monitor statistics - regularly check the rule counters
  6. Hairpin NAT - configure it when you need LAN access to public IPs
  7. Backups - save the configuration before making changes
  8. Firewall rules - do not forget about the firewall for DNAT traffic

Limitations and recommendations

Scaling

Recommendations for the number of hosts per public IP:

  • Optimal: 1-256 hosts
  • Acceptable: 256-512 hosts
  • Maximum: ~2000 hosts (with proper configuration)

Protocols

NAT works well with:

  • TCP
  • UDP
  • ICMP

There may be issues with:

  • FTP (use a conntrack helper)
  • SIP (use a conntrack helper)
  • IPsec (use NAT-T)
  • GRE (a PPTP helper is required)

Connection tracking

Default timeouts:

  • TCP established: 432000s (5 days)
  • UDP stream: 180s
  • ICMP: 30s

Next steps

Reviewed by OpenNix LLC · Last updated on
FirewallPKI (Public Key Infrastructure)