render

content/masquerade-with-filter.rst

@@ -2,7 +2,7 @@ Only NAT packets you can deliver responses for
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 
 :slug: masquerade-with-filter
-:date: 2024-05-08
+:date: 2024-05-08 13:32
 :tags: linux
 :category: til
 :keywords: nat, nftables, network

output/feeds/all.atom.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/all.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-05-08T00:00:00+02:00</updated><entry><title>Only NAT packets you can deliver responses for</title><link href="https://blog.ledoian.cz/masquerade-with-filter.html" rel="alternate"></link><published>2024-05-08T00:00:00+02:00</published><updated>2024-05-08T00:00:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-05-08:/masquerade-with-filter.html</id><summary type="html">&lt;p&gt;When setting up a masquerading nat, it is worth considering masquerading only
+<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/all.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-05-08T13:32:00+02:00</updated><entry><title>Only NAT packets you can deliver responses for</title><link href="https://blog.ledoian.cz/masquerade-with-filter.html" rel="alternate"></link><published>2024-05-08T13:32:00+02:00</published><updated>2024-05-08T13:32:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-05-08:/masquerade-with-filter.html</id><summary type="html">&lt;p&gt;When setting up a masquerading nat, it is worth considering masquerading only
 packets from known networks. That is, instead of rule like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt;
 masquerade&lt;/tt&gt; use something like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt; ip saddr 198.51.100.0/24
 masquerade&lt;/tt&gt;.&lt;/p&gt;

output/feeds/til.atom.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog - til</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/til.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-05-08T00:00:00+02:00</updated><entry><title>Only NAT packets you can deliver responses for</title><link href="https://blog.ledoian.cz/masquerade-with-filter.html" rel="alternate"></link><published>2024-05-08T00:00:00+02:00</published><updated>2024-05-08T00:00:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-05-08:/masquerade-with-filter.html</id><summary type="html">&lt;p&gt;When setting up a masquerading nat, it is worth considering masquerading only
+<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog - til</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/til.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-05-08T13:32:00+02:00</updated><entry><title>Only NAT packets you can deliver responses for</title><link href="https://blog.ledoian.cz/masquerade-with-filter.html" rel="alternate"></link><published>2024-05-08T13:32:00+02:00</published><updated>2024-05-08T13:32:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-05-08:/masquerade-with-filter.html</id><summary type="html">&lt;p&gt;When setting up a masquerading nat, it is worth considering masquerading only
 packets from known networks. That is, instead of rule like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt;
 masquerade&lt;/tt&gt; use something like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt; ip saddr 198.51.100.0/24
 masquerade&lt;/tt&gt;.&lt;/p&gt;