To expand the functionality of nat66, you need to add the port and protocol commands.
Proposal commands to Source NAT66:
vyos@vyos# set nat66 source rule 100 Possible completions: description Rule description disable Disable NAT66 rule log NAT66 rule logging outbound-interface Outbound interface of NAT66 traffic protocol Protocol to NAT66 ---> add command > source IPv6 source prefix options > translation Translated IPv6 address options vyos@vyos# set nat66 source rule 100 source Possible completions: prefix IPv6 prefix to be translated port Port number ---> add command vyos@vyos# set nat66 source rule 100 destination Possible completions: prefix IPv6 prefix to be translated port Port number ---> add command
Proposal commands to Destination NAT66:
vyos@vyos# set nat66 destination rule 100 Possible completions: description Rule description > destination IPv6 destination prefix options disable Disable NAT66 rule exclude Exclude packets matching this rule from NAT inbound-interface Inbound interface of NAT66 traffic log NAT66 rule logging protocol Protocol to NAT66 ---> add command > source IPv6 source prefix options > translation Translated IPv6 address options vyos@vyos# set nat66 destination rule 100 destination Possible completions: address IPv6 address or prefix to be translated port Port number ---> add command vyos@vyos# set nat66 destination rule 100 source Possible completions: address IPv6 address or prefix to be translated port Port number ---> add command
An example of using the dport rule in nftables for source and destination:
table ip6 nat { chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; counter jump VYOS_DNPT_HOOK iifname "eth0" tcp dport { 80 } counter dnat to fd00:1111:1111:1111::10 } chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; counter jump VYOS_SNPT_HOOK oifname "eth0" tcp dport { 80 } counter snat to 2001:1111:1111:1111::10 } chain VYOS_DNPT_HOOK { return } chain VYOS_SNPT_HOOK { return } }