Section 15 - when to use NAT or Mangle tables?

GRO 108

I'm hoping someone can provide a scenario to illustrate when it would be appropriate to use an entry in the NAT table and when to use the Mangle table? And describing why that table was the appropriate choice. My interpretation is that there's some overlap in the chains that they target.

edit: is NAT outgoing traffic only?

GRO 108

I've been able to answer my own question after getting to the labs and checking the man page for nft

┌───────┬──────────┬─────────────────────────────────────┬─────────────────────────────────────┐
│Type │ Families │ Hooks │ Description │
├───────┼──────────┼─────────────────────────────────────┼─────────────────────────────────────┤
│filter │ all │ all │ Standard chain type to use in │
│ │ │ │ doubt. │
├───────┼──────────┼─────────────────────────────────────┼─────────────────────────────────────┤
│nat │ ip, ip6 │ prerouting, input, output, │ Chains of this type perform Native │
│ │ │ postrouting │ Address Translation based on con‐ │
│ │ │ │ ntrack entries. Only the first │
│ │ │ │ packet of a connection actually │
│ │ │ │ traverses this chain - its rules │
│ │ │ │ usually define details of the cre‐ │
│ │ │ │ ated conntrack entry (NAT state‐ │
│ │ │ │ ments for instance). │
├───────┼──────────┼─────────────────────────────────────┼─────────────────────────────────────┤
│route │ ip, ip6 │ output │ If a packet has traversed a chain │
│ │ │ │ of this type and is about to be ac‐ │
│ │ │ │ cepted, a new route lookup is per‐ │
│ │ │ │ formed if relevant parts of the IP │
│ │ │ │ header have changed. This allows to │
│ │ │ │ e.g. implement policy routing se‐ │
│ │ │ │ lectors in nftables. │
└───────┴──────────┴─────────────────────────────────────┴─────────────────────────────────────┘

luisviveropena

Hi @GRO 108 ,

You also can take a look to the iptables man page:

https://ipset.netfilter.org/iptables.man.html

[...]

nat:
This table is consulted when a packet that creates a new connection is encountered. It consists of four built-ins: PREROUTING (for altering packets as soon as they come in), INPUT (for altering packets destined for local sockets), OUTPUT (for altering locally-generated packets before routing), and POSTROUTING (for altering packets as they are about to go out). IPv6 NAT support is available since kernel 3.7.

mangle:
This table is used for specialized packet alteration. Until kernel 2.4.17 it had two built-in chains: PREROUTING (for altering incoming packets before routing) and OUTPUT (for altering locally-generated packets before routing). Since kernel 2.4.18, three other built-in chains are also supported: INPUT (for packets coming into the box itself), FORWARD (for altering packets being routed through the box), and POSTROUTING (for altering packets as they are about to go out).

Regards,
Luis.

lee42x

Some example uses of the mangle table are altering elements of the packet header like TTL or mtu. These are usually specialized cases. There are additional tables that fall int the specialized category such as "security" and "raw" . Netfilter is very flexible and feature rich so there are many options that can be used.