Support redirect about nftables HOT 6 CLOSED

It’s implemented now :).

That said, if I understand https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)#Redirect correctly, you could have used a dnat rule to the same effect.

from nftables.

@stapelberg Any chance you could walk me through with comments test you added? I want to make sure I get the logic of building expr right:

		Exprs: []expr.Any{
			// [ meta load l4proto => reg 1 ]
			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
			// [ cmp eq reg 1 0x00000006 ]
			&expr.Cmp{
				Op:       expr.CmpOpEq,
				Register: 1,
				Data:     []byte{unix.IPPROTO_TCP},
			},

The rule will be applied to TCP traffic ^^^

 			// [ payload load 2b @ transport header + 2 => reg 1 ]
			&expr.Payload{
				DestRegister: 1,
				Base:         expr.PayloadBaseTransportHeader,
				Offset:       2, // TODO
				Len:          2, // TODO
			},
			// [ cmp eq reg 1 0x00001600 ]
			&expr.Cmp{
				Op:       expr.CmpOpEq,
				Register: 1,
				Data:     []byte{0x00, 0x16},
			},

Could you please explain ^^^, does it have something to do with specifying source port?

 			// [ immediate reg 1 0x0000ae08 ]
			&expr.Immediate{
				Register: 1,
				Data:     binaryutil.BigEndian.PutUint16(2222),
			},

expr.Immediate why it is used here, I suspect this is the way you load redirect to port

 			// [ redir proto_min reg 1 ]
			&expr.Redir{
				RegisterProtoMin: 1,
			},
		},

from nftables.

Could you please explain ^^^, does it have something to do with specifying source port?

Yeah, I probably should have just used BigEndian.PutUint16(22) for clarity.

The whole expression is taken from nft --debug all add rule nat prerouting tcp dport 22 redirect to 2222

from nftables.

@stapelberg great, --debug looks very useful! thanks a lot..

from nftables.

@stapelberg Appreciate you could comment how to implement this immediate expression:

[ immediate reg 0 jump -> chain_2 ]

it seems data actually consists out of 2 parts, jump command (I suspect, the code is ff fd) and chain name.

from nftables.

I’d need to look at that in more detail. Can you open a separate issue including an nft command I can use to test?

from nftables.