PO0 到 RFC 再到多落地：一次 nftables 转发链路学习记录

1
#!/usr/sbin/nft -f
2

3
define WAN_IF = "eth0"
4
define PO0_LAN_IP = 10.0.0.10
5
define RFC_IP = 198.51.100.10
6

7
define PORT_DIRECT = 50000
8
define PORT_LAND1 = 51001
9
define PORT_LAND2 = 51002
10
define PORT_LAND3 = 51003
11
define PORT_LAND4 = 51004
12

13
destroy table inet ss2022_po0_mangle
14
destroy table ip ss2022_po0_nat
15
destroy table inet ss2022_po0_filter
16

17
table inet ss2022_po0_mangle {
18
  chain forward {
19
    type filter hook forward priority -150; policy accept;
20

21
    ip daddr $RFC_IP tcp dport {
22
      $PORT_DIRECT,
23
      $PORT_LAND1,
24
      $PORT_LAND2,
25
      $PORT_LAND3,
26
      $PORT_LAND4
27
    } tcp flags syn tcp option maxseg size set 1360
28
  }
29
}
30

31
table ip ss2022_po0_nat {
32
  chain prerouting {
33
    type nat hook prerouting priority dstnat; policy accept;
34

35
    iifname $WAN_IF meta l4proto { tcp, udp } th dport $PORT_DIRECT dnat to $RFC_IP:$PORT_DIRECT
36
    iifname $WAN_IF meta l4proto { tcp, udp } th dport $PORT_LAND1 dnat to $RFC_IP:$PORT_LAND1
37
    iifname $WAN_IF meta l4proto { tcp, udp } th dport $PORT_LAND2 dnat to $RFC_IP:$PORT_LAND2
38
    iifname $WAN_IF meta l4proto { tcp, udp } th dport $PORT_LAND3 dnat to $RFC_IP:$PORT_LAND3
39
    iifname $WAN_IF meta l4proto { tcp, udp } th dport $PORT_LAND4 dnat to $RFC_IP:$PORT_LAND4
40
  }
41

42
  chain postrouting {
43
    type nat hook postrouting priority srcnat; policy accept;
44

45
    ip daddr $RFC_IP meta l4proto { tcp, udp } th dport {
46
      $PORT_DIRECT,
47
      $PORT_LAND1,
48
      $PORT_LAND2,
49
      $PORT_LAND3,
50
      $PORT_LAND4
51
    } snat to $PO0_LAN_IP
52
  }
53
}
54

55
table inet ss2022_po0_filter {
56
  chain forward {
57
    type filter hook forward priority 0; policy drop;
58

59
    ct state invalid drop
60
    ct state established,related accept
61

62
    ct status dnat ip daddr $RFC_IP meta l4proto { tcp, udp } th dport {
63
      $PORT_DIRECT,
64
      $PORT_LAND1,
65
      $PORT_LAND2,
66
      $PORT_LAND3,
67
      $PORT_LAND4
68
    } ct state new accept
69
  }
70
}

1
#!/usr/sbin/nft -f
2

3
define OUT_IF = "eth0"
4
define PO0_LAN_IP = 10.0.0.10
5

6
define LAND1_IP = 192.0.2.11
7
define LAND1_PORT = 51001
8

9
define LAND2_IP = 192.0.2.12
10
define LAND2_PORT = 51002
11

12
define LAND3_IP = 192.0.2.13
13
define LAND3_PORT = 51003
14

15
define LAND4_IP = 192.0.2.14
16
define LAND4_PORT = 51004
17

18
destroy table inet ss2022_rfc_mangle
19
destroy table ip ss2022_rfc_nat
20
destroy table inet ss2022_rfc_filter
21

22
table inet ss2022_rfc_mangle {
23
  chain forward {
24
    type filter hook forward priority -150; policy accept;
25

26
    ip daddr $LAND1_IP tcp dport $LAND1_PORT tcp flags syn tcp option maxseg size set 1360
27
    ip daddr $LAND2_IP tcp dport $LAND2_PORT tcp flags syn tcp option maxseg size set 1360
28
    ip daddr $LAND3_IP tcp dport $LAND3_PORT tcp flags syn tcp option maxseg size set 1360
29
    ip daddr $LAND4_IP tcp dport $LAND4_PORT tcp flags syn tcp option maxseg size set 1360
30
  }
31
}
32

33
table ip ss2022_rfc_nat {
34
  chain prerouting {
35
    type nat hook prerouting priority dstnat; policy accept;
36

37
    ip saddr $PO0_LAN_IP meta l4proto { tcp, udp } th dport $LAND1_PORT dnat to $LAND1_IP:$LAND1_PORT
38
    ip saddr $PO0_LAN_IP meta l4proto { tcp, udp } th dport $LAND2_PORT dnat to $LAND2_IP:$LAND2_PORT
39
    ip saddr $PO0_LAN_IP meta l4proto { tcp, udp } th dport $LAND3_PORT dnat to $LAND3_IP:$LAND3_PORT
40
    ip saddr $PO0_LAN_IP meta l4proto { tcp, udp } th dport $LAND4_PORT dnat to $LAND4_IP:$LAND4_PORT
41
  }
42

43
  chain postrouting {
44
    type nat hook postrouting priority srcnat; policy accept;
45

46
    oifname $OUT_IF ip daddr $LAND1_IP meta l4proto { tcp, udp } th dport $LAND1_PORT masquerade
47
    oifname $OUT_IF ip daddr $LAND2_IP meta l4proto { tcp, udp } th dport $LAND2_PORT masquerade
48
    oifname $OUT_IF ip daddr $LAND3_IP meta l4proto { tcp, udp } th dport $LAND3_PORT masquerade
49
    oifname $OUT_IF ip daddr $LAND4_IP meta l4proto { tcp, udp } th dport $LAND4_PORT masquerade
50
  }
51
}
52

53
table inet ss2022_rfc_filter {
54
  chain forward {
55
    type filter hook forward priority 0; policy drop;
56

57
    ct state invalid drop
58
    ct state established,related accept
59

60
    ip saddr $PO0_LAN_IP ip daddr $LAND1_IP meta l4proto { tcp, udp } th dport $LAND1_PORT ct state new accept
61
    ip saddr $PO0_LAN_IP ip daddr $LAND2_IP meta l4proto { tcp, udp } th dport $LAND2_PORT ct state new accept
62
    ip saddr $PO0_LAN_IP ip daddr $LAND3_IP meta l4proto { tcp, udp } th dport $LAND3_PORT ct state new accept
63
    ip saddr $PO0_LAN_IP ip daddr $LAND4_IP meta l4proto { tcp, udp } th dport $LAND4_PORT ct state new accept
64
  }
65
}