Skip to main content

Linux Static NAT Configuration Using TC

In this Document we will go through the static NAT(also called stateless NAT) configuration using TC Flower.

Required Linux Modules

root@dent-1:/usr/src/linux-5.16.9# lsmod
Module Size Used by
sch_htb 36864 1
sch_ingress 16384 1
act_nat 16384 2

NAT Configuration Example

Topology

topology1

The requirement here is to create 1:1 nating for PC1 ip (from 192.168.1.3 to 192.168.122.47).

Configuration

  • Create Egress Qdisc on the enp0s4 link, here we used a htb type, but another other type can be used.
  • Create Filter to match packet with PC1 as source ip, and the action is to do egress nat to 192.168.122.47.
  • Create Ingress Qdisc on the enp0s4 link.
  • Create Filter to match packet with 192.168.122.47 as destination ip, and the action is to do ingress nat to PC1 ip 192.168.1.3.
qdiscs-iproute2
qdisc enp0s4 root
qdisc-kind htb
special-qdisc enp0s4 ingress

tc-filters-iproute2
qdisc-filter enp0s4 0:
rule 10
protocol ip
filter flower match src_ip 192.168.1.3
filter flower actions nat direction egress
filter flower actions nat old_ip 192.168.1.3
filter flower actions nat new_ip 192.168.122.47
dev-filter enp0s4 ingress
rule 10
protocol ip
filter flower match dst_ip 192.168.122.47
filter flower actions nat direction ingress
filter flower actions nat old_ip 192.168.122.47
filter flower actions nat new_ip 192.168.1.3

Verify

  • PC1 can access the internet:
PC1> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=108 time=87.4 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=108 time=93.6 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=108 time=81.9 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=108 time=89.3 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=108 time=88.8 ms

  • In the capture taken from dent-1 interface enp0s4 we can see that translated ip address:

capture