Is address mandatory on nftables dnat rules?
Issue
- Is address mandatory on nftables dnat rules?
- Before RHEL 10.1, the
nftman page suggests that address is always required on Destination NAT rules:
NAT STATEMENTS
dnat [[ip | ip6] [ prefix ] to] ADDR_SPEC [:PORT_SPEC] [FLAGS]
- However, adding a DNAT firewall rule without an address works, eg:
nft add table translate_port
nft add chain ip translate_port output { type nat hook output priority -100 \; }
nft add rule translate_port output tcp dport 2200 dnat to :220
Environment
- Red Hat Enterprise Linux 8 and later
- nftables firewall
- Destination NAT rules using
dnatstatement
- Destination NAT rules using
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
