PR: https://github.com/vyos/vyos-1x/pull/1560

It seems like I was wrong about the netfilter rule not working as intended (and in my testing the clamp was broken for some other reason that was an error on my part), the post has been edited to only indicate the remaining issue of an overly strict MSS clamping range.

Send steps to reproduce it or “show conf com | match nat”

Send steps to reproduce it or “show conf com | match openvpn ”

See https://unix.stackexchange.com/questions/672742/why-mss-clamping-in-iptables-nft-seems-to-take-no-effect-in-nftables for additional explanation why the iptables version do not work under iptables-nft.

Relevant PRs:

PR for Jump: https://github.com/vyos/vyos-1x/pull/1553

PR with feature request:
https://github.com/vyos/vyos-1x/pull/1555

DEMO
===============================================

To demonstrate the feature let's look at the following topology

@sdev @Netboy3 I'll test if the new implementation is done and if the bug is fixed I'll close this PR, thanks

@jack9603301 I've tested your updated PR and it seems to work well now. Thank you for the quick response.
@sdev I've tested your PR and it seems to also fix both issues. I did not test anything beyond DNAT port only in both ip and ip6 families.

Included a fix for this in NAT refactor: https://github.com/vyos/vyos-1x/pull/1552

PR for NAT included with refactor: https://github.com/vyos/vyos-1x/pull/1552

@jack9603301, your PR solves the NAT66 issue - thank you. However, the change you made to nat.py to try to solve the NAT44 issue is not complete and seem to also require a template change. I'll post additional details in the PR.

Since jump action was added, It would be good to also add "return" action

PR: https://github.com/vyos/vyos-1x/pull/1550

Initial PR here, https://github.com/vyos/vyos-1x/pull/1551.

It seems we have working ISIS segment routing:

@Netboy3 Let me modify the template to support

Why would you enforce an address? It is perfectly OK to have port-only DNAT66 without any destination address such as:
nft add rule ip6 nat PREROUTING iifname eth1 counter tcp dport 443 dnat to :3000
Problem is that the test logic breaks on this and spits out a wrong statement to NFT that barfs on it.

Maybe we should add check to NAT66 to enforce the given address

@n.fort Maybe set firewall name <name> rule <rule> ipsec match-gre? This feels a bit hacky though... Almost like match should be its own block and contain ipsec, none, or gre