FM / examples

/usr/share/doc/nftables/examples

Name	Size	Mode	Actions
sysvinit/	-	0755	rm
all-in-one.nft	1016	0644	edit dl rm
arp-filter.nft	129	0644	edit dl rm
bridge-filter.nft	197	0644	edit dl rm
ct_helpers.nft	1263	0755	edit dl rm
inet-filter.nft	187	0644	edit dl rm
inet-nat.nft	251	0644	edit dl rm
ipv4-filter.nft	182	0644	edit dl rm
ipv4-mangle.nft	74	0644	edit dl rm
ipv4-nat.nft	246	0644	edit dl rm
ipv4-raw.nft	137	0644	edit dl rm
ipv6-filter.nft	186	0644	edit dl rm
ipv6-mangle.nft	78	0644	edit dl rm
ipv6-nat.nft	253	0644	edit dl rm
ipv6-raw.nft	141	0644	edit dl rm
load_balancing.nft	1858	0755	edit dl rm
nat.nft	1165	0755	edit dl rm
netdev-ingress.nft	128	0644	edit dl rm
overview.nft	1077	0755	edit dl rm
pf.os	28884	0644	edit dl rm
README	475	0644	edit dl rm
secmark.nft	2404	0755	edit dl rm
sets_and_maps.nft	1278	0755	edit dl rm
workstation.nft	817	0755	edit dl rm

Edit: /usr/share/doc/nftables/examples/nat.nft (1165B)

#!/usr/sbin/nft -f

table ip nat {
	chain prerouting {
		type nat hook prerouting priority 0;

#Thanks to nftables maps, if you have a previous iptables NAT (destination NAT) ruleset like this:
		# % iptables -t nat -A PREROUTING -p tcp --dport 1000 -j DNAT --to-destination 1.1.1.1:1234
		# % iptables -t nat -A PREROUTING -p udp --dport 2000 -j DNAT --to-destination 2.2.2.2:2345
		# % iptables -t nat -A PREROUTING -p tcp --dport 3000 -j DNAT --to-destination 3.3.3.3:3456

# It can be easily translated to nftables in a single line:

dnat tcp dport map { 1000 : 1.1.1.1, 2000 : 2.2.2.2, 3000 : 3.3.3.3} \
				: tcp dport map { 1000 : 1234, 2000 : 2345, 3000 : 3456 }
	}

chain postrouting {
		type nat hook postrouting priority 0;

#Likewise, in iptables NAT (source NAT):
		# % iptables -t nat -A POSTROUTING -s 192.168.1.1 -j SNAT --to-source 1.1.1.1
		# % iptables -t nat -A POSTROUTING -s 192.168.2.2 -j SNAT --to-source 2.2.2.2
		# % iptables -t nat -A POSTROUTING -s 192.168.3.3 -j SNAT --to-source 3.3.3.3

# Translated to a nftables one-liner:

snat ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 }
	}
}

#!/usr/sbin/nft -f table ip nat { chain prerouting { type nat hook prerouting priority 0; #Thanks to nftables maps, if you have a previous iptables NAT (destination NAT) ruleset like this: # % iptables -t nat -A PREROUTING -p tcp --dport 1000 -j DNAT --to-destination 1.1.1.1:1234 # % iptables -t nat -A PREROUTING -p udp --dport 2000 -j DNAT --to-destination 2.2.2.2:2345 # % iptables -t nat -A PREROUTING -p tcp --dport 3000 -j DNAT --to-destination 3.3.3.3:3456 # It can be easily translated to nftables in a single line: dnat tcp dport map { 1000 : 1.1.1.1, 2000 : 2.2.2.2, 3000 : 3.3.3.3} \ : tcp dport map { 1000 : 1234, 2000 : 2345, 3000 : 3456 } } chain postrouting { type nat hook postrouting priority 0; #Likewise, in iptables NAT (source NAT): # % iptables -t nat -A POSTROUTING -s 192.168.1.1 -j SNAT --to-source 1.1.1.1 # % iptables -t nat -A POSTROUTING -s 192.168.2.2 -j SNAT --to-source 2.2.2.2 # % iptables -t nat -A POSTROUTING -s 192.168.3.3 -j SNAT --to-source 3.3.3.3 # Translated to a nftables one-liner: snat ip saddr map { 192.168.1.1 : 1.1.1.1, 192.168.2.2 : 2.2.2.2, 192.168.3.3 : 3.3.3.3 } } }