Re: Stateless NAT in nftables with maps for performance

On Fri, Sep 12, 2025 at 03:37:36PM +0200, Florian Westphal wrote:
> Juan Carlos Lazcano <[email protected]> wrote:
> > My echo/reply base icmp functionality for v4 is working atleast at a cursory glance, without further testing I'm not sure what other parts of icmp are not working with this approach.
> 
> Internal addresses leak via icmp dst unreach, redirects etc. which contain copies of
> the (rewritten or original) addresses.
> That in turn breaks path mtu discovery for instance:
> 
> Server may see internal address reflected in embedded header.
> Client can receive error for source address it doesn't have.
> 
> NAT engine also rewrites embedded headers, see e.g. nf_nat_ipv4_fn()
> in net/netfilter/nf_nat_proto.c and nf_nat_icmp_reply_translation() to
> avoid this.

I think this can be fixed by extending userspace to mangle the icmp
payload, I would like to reach this at some point.