1-to-1 NAT ipaddr range fails on 1.3.0-rc6

I’m trying to do 1-to-1 nat between two IP address pools with vyos 1.3-rc6, and it fails, I see a similar report with version 1.4, not sure if it’s related.

set nat destination rule 2002 destination address ‘10.72.1.0/24’
set nat destination rule 2002 inbound-interface ‘eth2.58’
set nat destination rule 2002 translation address ‘192.168.100.0/24’
set nat source rule 2002 outbound-interface ‘eth2.58’
set nat source rule 2002 source address ‘192.168.100.0/24’
set nat source rule 2002 translation address ‘10.72.1.0/24’
commit
WARNING: IP address 10.72.1.0/24 does not exist on the system!
[ nat ]
WARNING: IP address 10.72.1.0/24 does not exist on the system!
VyOS had an issue completing a command.

We are sorry that you encountered a problem while using VyOS.
There are a few things you can do to help us (and yourself):

  • Contact us using the online help desk if you have a subscription:
    https://support.vyos.io/

  • Make sure you are running the latest version of VyOS available at:

  • Consult the community forum to see how to handle this issue:

  • Join us on Slack where our users exchange help and advice:

When reporting problems, please include as much information as possible:

  • do not obfuscate any data (feel free to contact us privately if your
    business policy requires it)
  • and include all the information presented below

Report Time: 2021-09-21 22:25:26
Image Version: VyOS 1.3.0-rc6
Release Train: equuleus

Built by: Sentrium S.L.
Built on: Sun 22 Aug 2021 15:37 UTC
Build UUID: 965518de-857d-4e61-ab09-381aadf24eb1
Build Commit ID: 75b37b28b2e9ab

Architecture: x86_64
Boot via: installed image
System type: bare metal

Hardware vendor: Supermicro
Hardware model: SYS-5049A
Hardware S/N: S37
Hardware UUID: 8a26a400-dfdf-11e9-8000

Traceback (most recent call last):
File “/usr/libexec/vyos/conf_mode/nat.py”, line 201, in
apply(c)
File “/usr/libexec/vyos/conf_mode/nat.py”, line 189, in apply
cmd(f’{iptables_nat_config}’)
File “/usr/lib/python3/dist-packages/vyos/util.py”, line 161, in cmd
raise OSError(code, feedback)
PermissionError: [Errno 1] failed to run command: /tmp/vyos-nat-rules.nft
returned:
exit code: 1

noteworthy:
cmd ‘/tmp/vyos-nat-rules.nft’
returned (out):

returned (err):
/tmp/vyos-nat-rules.nft:17:1-143: Error: Could not process rule: Operation not supported
add rule ip nat PREROUTING iifname “eth2.58” counter dnat ip prefix to ip daddr map { 10.72.1.0/24 : 192.168.100.0/24 } comment “DST-NAT-2002”
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/tmp/vyos-nat-rules.nft:38:1-144: Error: Could not process rule: Operation not supported
add rule ip nat POSTROUTING oifname “eth2.58” counter snat ip prefix to ip saddr map { 192.168.100.0/24 : 10.72.1.0/24 } comment “SRC-NAT-2002”
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[[nat]] failed
Commit failed

You might want to post this on https://phabricator.vyos.net/

Hello @jimichu, and welcome to our community!

I’m not quite sure what the purpose of your NAT is.
But you could try changing the rules a bit:
set nat destination rule 2002 destination address 10.72.1.0/24
set nat destination rule 2002 inbound-interface eth2.58
set nat destination rule 2002 translation address 192.168.100.1-192.168.100.254
set nat source rule 2002 outbound-interface eth2.58
set nat source rule 2002 source address 192.168.100.0/24
set nat source rule 2002 translation address 10.72.1.1-10.72.1.254

vyos@vyos# commit
WARNING: IP address 10.72.1.1 does not exist on the system!
WARNING: IP address 10.72.1.254 does not exist on the system!
[edit]

HI, thanks for your suggestion. I’ve tried this, although the commit works, the translation between the two IP pools are not 1-to-1, what I wanted is 10.72.1.x - 192.168.100.x, but it seems to be picking randomly.

ok, I read that the nft_nat netmap support is only available after kernel v5.8, right now it’s 5.4 on vyos 1.3. I guess I’d have to add the nat rules one by one explicitly.

Try please the latest 1.3-beta release.

that worked! thanks!