Error configuring NAT with nftables

[Pavel Volkov]

I've used nftables to perform filtering for a while and today I tried to
configure it for NAT.

I took the example from nftables wiki [1]:
% nft add table nat
% nft add chain nat prerouting { type nat hook prerouting priority 0 \; }
% nft add chain nat postrouting { type nat hook postrouting priority 0 \; }

The first command completes fine, but the second gives me an error:
# nft add chain nat prerouting { type nat hook prerouting priority 0 \; }
<cmdline>:1:1-66: Error: Could not process rule: No such file or directory
add chain nat prerouting { type nat hook prerouting priority 0 ; }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Also tried this way:
# nft -f /etc/nftables/ipv4-nat
/etc/nftables/ipv4-nat:3:1-2: Error: Could not process rule: No such file
or directory
table nat {
^^
/etc/nftables/ipv4-nat:3:1-2: Error: Could not process rule: No such file
or directory
table nat {
^^

I'm using nftables 0.3 with kernel 3.16.3. Can you help me with it?


[1]
http://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_%28NAT%29
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

[Pablo Neira Ayuso]

Post by Pavel Volkov
I've used nftables to perform filtering for a while and today I
tried to configure it for NAT.
% nft add table nat
% nft add chain nat prerouting { type nat hook prerouting priority 0 \; }
% nft add chain nat postrouting { type nat hook postrouting priority 0 \; }
# nft add chain nat prerouting { type nat hook prerouting priority 0 \; }
<cmdline>:1:1-66: Error: Could not process rule: No such file or directory
add chain nat prerouting { type nat hook prerouting priority 0 ; }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Could not process rule: No such file or directory
table nat {
^^
/etc/nftables/ipv4-nat:3:1-2: Error: Could not process rule: No such
file or directory
table nat {
^^
I'm using nftables 0.3 with kernel 3.16.3. Can you help me with it?

Does your .config contain:

CONFIG_NFT_CHAIN_NAT_IPV4=m

# lsmod | grep nft_chain_nat_ipv4
nft_chain_nat_ipv4 12684 2
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

[Pavel Volkov]

Post by Pablo Neira Ayuso
CONFIG_NFT_CHAIN_NAT_IPV4=m
# lsmod | grep nft_chain_nat_ipv4
nft_chain_nat_ipv4 12684 2

You're right, this is what I missed. Thank you.
I hope the error messages will look more meaningful in the future :)
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html