SNAT (source NAT) for vrf - does this functional exist/work?

General questions
,
1

Hi everyone!

Does SNAT (or just NAT without clarification source or destination) for vrf in VyOS exist/work?

In documentation I only found examples for NAT without any vrfs (seems it means that NAT used in default vrf)

I try to do just SNAT with poining outbound interface and source range, but seems this is not working.

+++++
config and version:

admin@vyos-lns-1:~$ sho version

Version: VyOS 1.4-rolling-202204261551
Release train: sagitta

set interfaces ethernet eth1 vif 428 address ‘10.20.2.10/29’
set interfaces ethernet eth1 vif 428 vrf ‘client’

set nat source rule 10 outbound-interface ‘eth1.428’
set nat source rule 10 source address ‘20.20.20.20/32’
set nat source rule 10 translation address ‘masquerade’

set interfaces dummy dum2 address ‘20.20.20.20/32’
set interfaces dummy dum2 description ‘ip interface in vrf client’
set interfaces dummy dum2 vrf ‘client’

set vrf name client protocols static route 20.20.20.21/32 interface eth1.428

++++++

I check this by the pings:

admin@vyos-lns-1:~$ ping 20.20.20.21 vrf client source-address 20.20.20.20
PING 20.20.20.21 (20.20.20.21) from 20.20.20.20 : 56(84) bytes of data.
From 20.20.20.20 icmp_seq=1 Destination Host Unreachable
From 20.20.20.20 icmp_seq=2 Destination Host Unreachable
From 20.20.20.20 icmp_seq=3 Destination Host Unreachable
^C
— 20.20.20.21 ping statistics —
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 4122ms
pipe 4
admin@vyos-lns-1:~$

and there are no translations:

admin@vyos-lns-1:~$ sho nat source translations
admin@vyos-lns-1:~$

2

There’s a know issue in phabricator for NAT and VRF: ⚓ T3655 NAT Problem with VRF