NAT and port forwarding
NAT lets many machines share one address. On a dedicated server it is a reasonable tool and rarely the best one.
Consider a routed block first
If your guests need to be reachable, give each one a real address. We route a block to your server and you are done: no port juggling, no protocols that break, no hairpin problem. See additional addresses and routed subnets.
For IPv6 there is no excuse at all — addresses are not scarce. Give every guest its own and keep NAT for IPv4 where it genuinely saves something.
Outbound: masquerading
Guests on a private bridge, reaching the internet through the host:
sysctl -w net.ipv4.ip_forward=1
nft add table ip nat
nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }
nft add rule ip nat postrouting ip saddr 10.0.0.0/24 oif "eth0" masquerade
Make it permanent in /etc/nftables.conf and the sysctl in
/etc/sysctl.d/, or it disappears at the next reboot.
Inbound: port forwarding
nft add chain ip nat prerouting { type nat hook prerouting priority -100 \; }
nft add rule ip nat prerouting tcp dport 8080 dnat to 10.0.0.5:80
And make sure the forward chain allows it, which is the step that gets forgotten:
nft add rule inet filter forward ip daddr 10.0.0.5 tcp dport 80 ct state new accept
The hairpin problem
A guest tries to reach the public address of another guest on the same host and the connection hangs. The packet goes out to the public address, comes back, and the return path does not match.
The fix is a second NAT rule for traffic originating inside:
nft add rule ip nat postrouting ip saddr 10.0.0.0/24 ip daddr 10.0.0.5 tcp dport 80 masquerade
The better fix is to have your guests use internal addresses for each other, with an internal DNS name. See connecting your own servers.
What NAT breaks
- Inbound anything you did not forward. Obvious, and still the commonest surprise.
- Protocols carrying addresses in the payload — SIP, FTP, some game protocols. They need helpers or they misbehave.
- Logging. Every connection appears to come from one address; your rate limiting and your abuse handling both suffer.
- The conntrack table, which NAT fills faster than plain forwarding — see connection tracking.
Do not NAT other people's traffic
Running an open proxy or an open NAT gateway for anyone who can reach it is against the acceptable use policy, and it is how a machine ends up carrying abuse that is traced back to you. Bind it to your own private network and nothing else.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base