After upgrading from 1.3 to 1.4, I noticed that some of my internal traffic was getting NATed to the router’s IP on the transit network it’s getting routed over. I finally tracked this down to a policy route rule with set table main
.
Here’s my abbreviated config:
set interfaces ethernet eth0 vif 42 address '192.168.42.1/24'
set interfaces ethernet eth0 vif 200 address '10.11.80.2/28'
set interfaces ethernet eth0 vif 200 description 'transit'
set protocols static route 0.0.0.0/0 next-hop 10.11.80.1
There are several other VIFs and Wireguard tunnel interfaces set up, using OSPF for routing. But there is no nat config.
A really basic policy config demonstrates the surprising NAT behavior:
set policy route test interface 'eth0.42'
set policy route test rule 5 set table 'main'
set policy route test rule 5 source address '192.168.42.41'
Now I send a ping from 192.168.42.41 to 192.168.2.8. This will use an OSPF route that sends the traffic via 10.11.80.1 on eth0.200.
vyos@devrouter:~$ monitor traffic interface any filter "icmp and host 192.168.2.8"
20:36:36.086084 eth0.42 In IP 192.168.42.41 > 192.168.2.8: ICMP echo request, id 21846, seq 1, length 64
20:36:36.086134 eth0.200 Out IP 10.11.80.2 > 192.168.2.8: ICMP echo request, id 21846, seq 1, length 64
20:36:36.086622 eth0.200 In IP 192.168.2.8 > 10.11.80.2: ICMP echo reply, id 21846, seq 1, length 64
20:36:36.086636 eth0.42 Out IP 192.168.2.8 > 192.168.42.41: ICMP echo reply, id 21846, seq 1, length 64
But if I delete policy route test rule 5 set table main
and re-send the ping, I get no NAT:
vyos@devrouter:~$ monitor traffic interface any filter "icmp and host 192.168.2.8"
20:38:14.007456 eth0.42 In IP 192.168.42.41 > 192.168.2.8: ICMP echo request, id 34232, seq 1, length 64
20:38:14.007484 eth0.200 Out IP 192.168.42.41 > 192.168.2.8: ICMP echo request, id 34232, seq 1, length 64
20:38:14.007984 eth0.200 In IP 192.168.2.8 > 192.168.42.41: ICMP echo reply, id 34232, seq 1, length 64
20:38:14.007997 eth0.42 Out IP 192.168.2.8 > 192.168.42.41: ICMP echo reply, id 34232, seq 1, length 64
Is this expected behavior? It seems really strange that I’m getting masquerade behavior by explicitly selecting the main routing table.