SNAT (source NAT) for vrf - does this functional exist/work?


Hi everyone!

Does SNAT (or just NAT without clarification source or destination) for vrf in VyOS exist/work?

In documentation I only found examples for NAT without any vrfs (seems it means that NAT used in default vrf)

I try to do just SNAT with poining outbound interface and source range, but seems this is not working.

config and version:

admin@vyos-lns-1:~$ sho version

Version: VyOS 1.4-rolling-202204261551
Release train: sagitta

set interfaces ethernet eth1 vif 428 address ‘’
set interfaces ethernet eth1 vif 428 vrf ‘client’

set nat source rule 10 outbound-interface ‘eth1.428’
set nat source rule 10 source address ‘’
set nat source rule 10 translation address ‘masquerade’

set interfaces dummy dum2 address ‘’
set interfaces dummy dum2 description ‘ip interface in vrf client’
set interfaces dummy dum2 vrf ‘client’

set vrf name client protocols static route interface eth1.428


I check this by the pings:

admin@vyos-lns-1:~$ ping vrf client source-address
PING ( from : 56(84) bytes of data.
From icmp_seq=1 Destination Host Unreachable
From icmp_seq=2 Destination Host Unreachable
From icmp_seq=3 Destination Host Unreachable
— ping statistics —
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 4122ms
pipe 4

and there are no translations:

admin@vyos-lns-1:~$ sho nat source translations

There’s a know issue in phabricator for NAT and VRF: ⚓ T3655 NAT Problem with VRF