How to do Masquerading with NFTables

Question

How would I implement a masquerading rule like this iptables one in NFTables:

iptables -t nat -A POSTROUTING -s 10.5.6.0/24 -o eth0 -j MASQUERADE

I've looked for it, but couldn't find out how to set the output interface

Answer 1

You can write the rule this way:

nft add rule nat postrouting ip saddr 10.5.6.0/24 oif eth0 masquerade

Take a look on nftables nat wiki for more informations.

Answer 2

as an aside, if you were masquerading under a dynamic address, you could simply

add rule nat postrouting oif ppp0 masquerade

---

oif / oifname

Userspace converts oif to integer at runtime

You should use probably use oifname (slower string matching) rather than oif if the interface might disappear and then re-appear (like ppp0 and others may, upon disconnect, etc.) unless you'll make other arrangements to masquerade upon the interface coming up each time.

oif → if the interface is removed and created again, the match will not occur as the index of added interfaces in kernel is monotonically increasing.

—via nftables-quick-howto

Answer 3

I have the following "nat" table in my /etc/nftables.conf file, along with my other firewall rules which are in a separate "filter" table :

table ip nat {
    chain prerouting {
        type nat hook prerouting priority filter; policy accept;
    }
                 
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        oifname { "eno2" } masquerade   # "eno2" is our external interface
    }
}

table ip filter {
    # etc.