Re: Stateless NAT in nftables with maps for performance

Juan Carlos Lazcano <[email protected]> Fri, 12 Sep 2025 07:47:13 -0500 (EST)

Newsgroups	gmane.comp.security.firewalls.netfilter.general
Message-ID	<[email protected]>

You all are amazing.  Thank you for all that you do!

My echo/reply base icmp functionality for v4 is working atleast at a cursory glance, without further testing I'm not sure what other parts of icmp are not working with this approach.

> On 09/12/2025 8:23 AM  Florian Westphal <[email protected]> wrote:
> 
>  
> Florian Westphal <[email protected]> wrote:
> > ip daddr set ip daddr map @dnat_map
> 
> Forgot the usual disclaimer: this breaks icmp(v6).
> 
> There is a reason for existence of stateful nat after all.