NAT and the packet path on a Linux router: nftables, conntrack
You work with netfilter’s packet path, connection tracking and source/destination NAT in nftables, solving real problems such as port forwarding and hairpin NAT.
Level 301 · 18 lessons · 15 practice labs
Lessons
The packet path
- Netfilter hooks: from prerouting to postrouting
- nftables tables, chains and priority
- conntrack: connection states
- Reading the connection table with the conntrack tool
- Short task: follow one packet’s path with nft trace
NAT
- Reaching the internet with SNAT and masquerade
- Port forwarding with DNAT
- Hairpin NAT: reaching the public address from inside
- One-to-one NAT and address pools
- Protocols NAT breaks: FTP, SIP and helpers
- Short task: publish an internal web server to the outside safely
Filtering on the router
- Filtering routed traffic: the forward chain
- Rules that scale with sets and maps
- Rate limiting and counters
- Rule logging and tracing
- Migrating iptables rules to nftables
- Short task: separate the guest network from staff on the router
Wrap-up
- Capstone: build and document a NAT gateway for a small office
Practice labs
- Where does the ping die?: Follow a ping that cannot cross the router with nft trace, find the rule and chain dropping it, fix it and prove it with the trace output.
- Two tables, wrong priority: Show that an accept rule never runs because of chain priorities in two tables on the same hook, fix the priorities and confirm it with counters.
- Some connections drop at random: Catch with conntrack events the packets Caravan Travel’s router marks INVALID because of an asymmetric path, fix the root cause and show by measurement that the drops have stopped.
- The office cannot get out: Add the missing masquerade rule keeping internal clients off the outside network, and prove it by showing the source address the outside server sees.
- Each department with its own public address: SNAT the accounting and guest networks to two given public addresses, and show the right mapping in the outside server’s access log.
- The connection table is full: Prove that new connections fail at peak because the conntrack table is full, tune the limits and timeouts, and show the error gone under a load test.
- Watch the warehouse camera recorder from outside: Publish the warehouse camera recorder on one port of the outside interface with DNAT, show the other ports stay closed and prove it by opening the interface from an outside client.
- Works from outside, not from inside: Solve with hairpin NAT why internal users cannot reach the company site by its public address, and show access from both inside and outside.
- FTP connects but cannot list: Show with a capture why passive mode breaks on an FTP server behind NAT, set up the helper or a fixed port range correctly and prove a directory listing from outside.
- Plant network to the update server only: Let devices on Demirhan Machinery’s plant network reach only the update server through the forward chain, and show it by testing an allowed and a blocked destination.
- One set instead of a hundred rules: Move a long one-by-one block list into an nftables set, and show the drop in rule count and that the behaviour is unchanged with test clients.
- A burst of SSH attempts on the lab server: Write rules limiting a burst of SSH attempts at your lab server and logging offenders with a prefix, then repeat the burst and prove the effect with counters and logs.
- Translate the old iptables script: Translate Tulip Pharmacy’s old iptables script into nftables rules, and show the same test traffic gets the same results.
- NAT is gone after a reboot: Make the NAT and filtering rules that vanish on every gateway reboot persistent, and prove it with a test after a restart.
- iptables and nftables side by side: On a gateway with both iptables-nft and native nft rules, find the conflicting rules, merge them into one documented nftables ruleset and show every service still works.
About this course
You work with netfilter’s packet path, connection tracking and source/destination NAT in nftables, solving real problems such as port forwarding and hairpin NAT.
What you will learn
- The packet path
- NAT
- Filtering on the router
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.