set vpp nat nat44 exclude rule N local-address <inside-host> a way to exclude a specific inside host from NAT44 translation. Instead, it makes that host unreachable. VPP drops the host's own ARP requests to the gateway, because the exclude rule is implemented as an address-only identity mapping, which VPP treats as "this address is one of my own.
Steps to reproduce:
Topology: inside host -> NAT44 gateway (VPP-bound inside/outside interfaces) -> outside host.
# GW NAT
set vpp settings interface eth1
set vpp settings interface eth3
set interfaces ethernet eth1 address '192.168.1.1/29'
set interfaces ethernet eth3 address '203.0.113.1/24'
set vpp nat nat44 interface inside eth1
set vpp nat nat44 interface outside eth3
set vpp nat nat44 address-pool translation address '203.0.113.50'
set vpp nat nat44 exclude rule 10 local-address '192.168.1.2'
commit
# Inside host
ping 203.0.113.2 source-address 192.168.1.2
vyos@vpp1-r2# vppctl show ip fib 192.168.1.2/32
ipv4-VRF:0, fib_index:0, flow hash:[src dst sport dport proto flowlabel ] epoch:0 flags:none locks:[default-route:1, lcp-rt:1, nat-low:2, nat-hi:2, ]
192.168.1.2/32 fib:0 index:23 locks:2
nat-low refs:1 entry-flags:connected,exclusive,local, src-flags:added,contributing,active,
path-list:[37] locks:2 flags:local,exclusive, uPRF-list:29 len:0 itfs:[]
path:[53] pl-index:37 ip4 weight=1 pref=0 receive: oper-flags:resolved, cfg-flags:exclusive,attached,local,
[@0]: dpo-receive: 192.168.1.2 on eth3
forwarding: unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:24 buckets:1 uRPF:29 to:[0:0]]
[0] [@12]: dpo-receive: 192.168.1.2 on eth3
[edit]If you remove and then re-add the rule, ARP starts to pass because of a change in the FIB it gets added with an adjacency entry, and traffic passes through
vyos@vpp1-r2# vppctl show ip fib 192.168.1.2/32
ipv4-VRF:0, fib_index:0, flow hash:[src dst sport dport proto flowlabel ] epoch:0 flags:none locks:[adjacency:1, default-route:1, lcp-rt:1, nat-low:2, nat-hi:2, ]
192.168.1.2/32 fib:0 index:23 locks:3
adjacency refs:1 entry-flags:attached, src-flags:added,contributing,active, cover:16
path-list:[37] locks:2 uPRF-list:29 len:1 itfs:[1, ]
path:[53] pl-index:37 ip4 weight=1 pref=0 attached-nexthop: oper-flags:resolved,
192.168.1.2 eth1
[@0]: ipv4 via 192.168.1.2 eth1: mtu:1500 next:5 flags:[] 5254000101005254000201000800
Extensions:
path:53 adj-flags:[refines-cover]
nat-low refs:1 entry-flags:connected,exclusive,local, src-flags:added,
path-list:[39] locks:1 flags:local,exclusive, uPRF-list:31 len:0 itfs:[]
path:[55] pl-index:39 ip4 weight=1 pref=0 receive: oper-flags:resolved, cfg-flags:exclusive,attached,local,
[@0]: dpo-receive: 192.168.1.2 on eth3
forwarding: unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:24 buckets:1 uRPF:29 to:[812:68208]]
[0] [@5]: ipv4 via 192.168.1.2 eth1: mtu:1500 next:5 flags:[] 5254000101005254000201000800
[edit]
vyos@vpp1-r2#Expected:
The host's traffic reaches the outside with its real address, untranslated exactly as "exclude
from NAT" implies while the rest of the NAT44 traffic is translated normally.