NAT and Port Forwarding with nftables

Network address translation lets many hosts share one public address, and lets you publish a service running on an internal machine. Both need the kernel to forward packets, a source or destination rewrite, and usually a rule that decides what may cross.

Masquerade: sharing one address

Outgoing LAN traffic gets the WAN address as its source. The router remembers each connection and sends the replies back to the right host. Masquerade (rather than a fixed snat) suits a WAN address that changes.

table ip router_nat {
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        oifname "eth0" ip saddr { 192.168.1.0/24 } masquerade
    }
}

Port forwarding with DNAT

A rewrite on the way in: traffic arriving on a WAN port gets a new destination inside the LAN. The reply path is handled automatically by connection tracking.

iifname "eth0" tcp dport 8080 dnat to 192.168.1.10:80

Turn routing on

None of this works unless the kernel forwards packets: net.ipv4.ip_forward must be 1. Put it in /etc/sysctl.d so it survives a reboot.

net.ipv4.ip_forward = 1

Hairpin NAT

A LAN host that connects to the router's public address expects the forwarded service, but the packet never leaves the LAN. A second rewrite on the way back, and a masquerade for the LAN-to-LAN leg, fixes it.

Filtering forwarded traffic

With the forward chain set to drop by default, allow replies, LAN to WAN, and traffic that was DNAT-ed. Rules in another table that drop a packet still win, because a packet must be accepted by every table that sees it.

Open the NAT & port forwarding generator

Frequently asked questions

Why does forwarding port 22 lock me out?

Traffic to the WAN address on port 22 is rewritten to the internal host, so SSH to the router itself no longer answers there. Keep another way in first.

Does this work for IPv6?

IPv6 does not need NAT: hosts get global addresses. Filter them with the firewall instead.

Can I use these next to ufw or firewalld?

They use their own tables, so they coexist, but a drop in the other firewall still blocks the forward.

Guides

• Nginx Reverse Proxy Configuration
• Caddy Reverse Proxy Configuration
• Nginx Static Site Configuration
• Caddy Static Site Configuration
• Nginx + PHP-FPM Configuration
• Caddy + PHP-FPM Configuration
• Nginx SSL/TLS Configuration
• Nginx Load Balancer Configuration
• Caddy Load Balancer Configuration
• Nginx Rate Limiting Configuration
• Nginx Security Headers Configuration
• Caddy Security Headers Configuration
• Nginx Gzip Compression Configuration
• Nginx Caching Configuration
• Caddy HTTPS Redirect Configuration
• Nginx WebSocket Proxy Configuration
• Nginx Content-Security-Policy Header
• Block Bad Bots and Scanners in Nginx
• fail2ban for Nginx
• nginx.conf Best Practices
• Nginx Location Regex Tester
• Deploy Nginx Config with GitHub Actions
• Nginx CORS Headers Configuration
• Nginx Cache-Control Headers Configuration
• Nginx 301 Redirect Map Configuration
• robots.txt, Sitemap and security.txt
• Apache .htaccess Configuration
• Docker Compose and Dockerfile Configuration
• systemd Service and Timer Configuration
• Cron Expression Explainer
• SSH Hardening with sshd_config
• Linux Firewall Rules: ufw, nftables and iptables
• Glob Pattern Tester
• Analysing Nginx Access Logs with awk
• Subnet Mask and CIDR Calculator
• VLAN Configuration on Linux
• Static Routes and Policy Routing on Linux
• NAT and Port Forwarding with nftables
• DHCP Server Configuration
• BIND Zone File Example
• WireGuard Server and Client Configuration