Blame SOURCES/nat.nft

168a1c
# Sample configuration snippet for nftables service.
168a1c
# Meant to be included by main.nft, not for direct use.
168a1c
168a1c
# dedicated table for IPv4
168a1c
table ip nftables_svc {
168a1c
168a1c
	# interfaces to masquerade traffic from
168a1c
	set masq_interfaces {
168a1c
		type ifname
168a1c
		elements = { "virbr0" }
168a1c
	}
168a1c
168a1c
	# networks to masquerade traffic from
168a1c
	# 'interval' flag is required to support subnets
168a1c
	set masq_ips {
168a1c
		type ipv4_addr
168a1c
		flags interval
168a1c
		elements = { 192.168.122.0/24 }
168a1c
	}
168a1c
168a1c
	# base-chain to manipulate conntrack in postrouting,
168a1c
	# will see packets for new or related traffic only
168a1c
	chain POSTROUTING {
168a1c
		type nat hook postrouting priority srcnat + 20
168a1c
		policy accept
168a1c
168a1c
		iifname @masq_interfaces oifname != @masq_interfaces masquerade
168a1c
		ip saddr @masq_ips masquerade
168a1c
	}
168a1c
}