A router firewall with NAT

# /etc/sysctl.d/99-forwarding.conf: let fw route between the office and the internet.
net.ipv4.ip_forward = 1

root@pc:~# ping -c 2 -W 1 203.0.113.50 | tail -2
2 packets transmitted, 0 received, 100% packet loss, time 1063ms


root@fw:~# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0

root@fw:~# cp 99-forwarding.conf /etc/sysctl.d/ && sysctl --system | grep ip_forward
net.ipv4.ip_forward = 1

root@pc:~# ping -c 2 -W 1 203.0.113.50 | tail -2
2 packets transmitted, 0 received, 100% packet loss, time 1029ms

• Lines 1–2: The office PC can't reach the internet.
• Lines 5–6: Debian's default: no routing.
• Lines 8–9: On, now and after every reboot.
• Lines 11–12: Still failing, but for a new reason…

root@inet:~# timeout 5 tcpdump -lnni eth0 icmp
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
07:47:37.238174 IP 10.10.0.20 > 203.0.113.50: ICMP echo request, id 47951, seq 1, length 64
07:47:38.267155 IP 10.10.0.20 > 203.0.113.50: ICMP echo request, id 47951, seq 2, length 64

2 packets captured
2 packets received by filter
0 packets dropped by kernel

• Lines 4–5: The pings arrive from 10.10.0.20, a private address. The internet host can't send replies there.

root@inet:~# ip route add 10.10.0.0/24 via 203.0.113.10 && curl -s -o /dev/null -w "%{http_code}\n" -m 3 http://10.10.0.80/
200

root@srv:~# tail -1 /tmp/web.log
203.0.113.50 - - [21/Oct/2026 07:47:48] "GET / HTTP/1.1" 200 -

• Lines 1–2: A neighbour on the WAN segment routes the office's private range at the firewall, and reaches the web server.
• Lines 4–5: The web server sees a visitor from the internet.

#!/usr/sbin/nft -f
# /etc/nftables.conf on fw: the office's router and firewall.
# Check, then load:  nft -c -f /etc/nftables.conf && systemctl reload nftables
flush ruleset

define WAN = "eth0"
define LAN = "eth1"
define WEBSERVER = 10.10.0.80

table inet filter {
  set admins {
    type ipv4_addr
    elements = { 10.10.0.20 }
  }

  chain input {
    type filter hook input priority filter; policy drop;
    ct state established,related accept
    ct state invalid drop
    iif lo accept
    icmp type { echo-request, destination-unreachable, time-exceeded } accept
    iifname $LAN ip saddr @admins tcp dport 22 accept comment "SSH from admin PCs"
    limit rate 6/minute burst 5 packets log prefix "nft input drop: "
    counter comment "dropped by the policy"
  }

  chain forward {
    type filter hook forward priority filter; policy drop;
    ct state established,related accept
    ct state invalid drop
    iifname $LAN oifname $WAN accept comment "the office to the internet"
    iifname $WAN oifname $LAN ct status dnat accept comment "port forwards, see the nat table"
    limit rate 6/minute burst 5 packets log prefix "nft forward drop: "
    counter comment "dropped by the policy"
  }

  chain output {
    type filter hook output priority filter; policy accept;
  }
}

table ip nat {
  chain prerouting {
    type nat hook prerouting priority dstnat;
    iifname $WAN tcp dport 8080 dnat to $WEBSERVER:80 comment "port forward to the office web server"
  }

  chain postrouting {
    type nat hook postrouting priority srcnat;
    oifname $WAN masquerade comment "the office shares the firewall's public address"
  }
}

• Lines 6–8: Names for interfaces and addresses, used below.
• Lines 11–14: A set of admin addresses; see Sets and maps.
• Lines 23–24: Log a few dropped packets, and count them all.
• Line 28: The forward policy: nothing is routed unless a rule allows it.
• Line 31: The office may go out.
• Line 32: From the internet, only what the nat table port-forwards.
• Lines 42–46: DNAT on prerouting: 203.0.113.10:8080 becomes the web server, before routing.
• Lines 48–51: Masquerade on postrouting: the office leaves as the firewall's address.

root@fw:~# cp router.conf /etc/nftables.conf && nft -c -f /etc/nftables.conf && systemctl reload nftables && nft list ruleset
table inet filter {
	set admins {
		type ipv4_addr
		elements = { 10.10.0.20 }
	}

	chain input {
		type filter hook input priority filter; policy drop;
		ct state established,related accept
		ct state invalid drop
		iif "lo" accept
		icmp type { destination-unreachable, echo-request, time-exceeded } accept
		iifname "eth1" ip saddr @admins tcp dport 22 accept comment "SSH from admin PCs"
		limit rate 6/minute burst 5 packets log prefix "nft input drop: "
		counter packets 0 bytes 0 comment "dropped by the policy"
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state established,related accept
		ct state invalid drop
		iifname "eth1" oifname "eth0" accept comment "the office to the internet"
		iifname "eth0" oifname "eth1" ct status dnat accept comment "port forwards, see the nat table"
		limit rate 6/minute burst 5 packets log prefix "nft forward drop: "
		counter packets 0 bytes 0 comment "dropped by the policy"
	}

	chain output {
		type filter hook output priority filter; policy accept;
	}
}
table ip nat {
	chain prerouting {
		type nat hook prerouting priority dstnat; policy accept;
		iifname "eth0" tcp dport 8080 dnat to 10.10.0.80:80 comment "port forward to the office web server"
	}

	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "eth0" masquerade comment "the office shares the firewall's public address"
	}
}

• Line 1: Copy, check, reload: the service runs nft -f /etc/nftables.conf again.
• Line 14: Variables are gone: the kernel only stores values.
• Lines 33–43: The nat table, with policies filled in (nat chains always accept).

root@pc:~# curl -s -o /dev/null -w "%{http_code}\n" http://203.0.113.50/; ping -c 1 -W 1 203.0.113.50 | tail -2
200
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.033/0.033/0.033/0.000 ms

root@inet:~# tail -1 /tmp/web.log
203.0.113.10 - - [21/Oct/2026 07:48:10] "GET / HTTP/1.1" 200 -

root@fw:~# conntrack -L -p tcp --dport 80 2>/dev/null
tcp      6 119 TIME_WAIT src=10.10.0.20 dst=203.0.113.50 sport=39654 dport=80 src=203.0.113.50 dst=203.0.113.10 sport=80 dport=39654 [ASSURED] mark=0 use=1

root@inet:~# curl -s -o /dev/null -w "%{http_code}\n" -m 3 http://10.10.0.80/; curl -s -o /dev/null -w "%{http_code}\n" -m 3 http://203.0.113.10:8080/
000
200

root@srv:~# tail -1 /tmp/web.log
203.0.113.50 - - [21/Oct/2026 07:48:13] "GET / HTTP/1.1" 200 -

root@fw:~# nft list chain inet filter forward | grep -E "dnat|dropped"
		iifname "eth0" oifname "eth1" ct status dnat accept comment "port forwards, see the nat table"
		counter packets 3 bytes 180 comment "dropped by the policy"

• Lines 1–4: The office reaches the internet.
• Lines 6–7: …as the firewall's address.
• Lines 9–10: conntrack's record: the original direction, and the reply direction with the rewritten address.
• Lines 12–14: The neighbour's direct route is dropped now (000); the port forward works.
• Lines 16–17: Through the port forward, the web server sees the visitor's real address.
• Lines 19–21: Three dropped packets: the neighbour's SYN and two retries.

root@fw:~# systemctl is-active nftables; nft list tables
active
table inet filter
table ip nat

• Lines 2–4: The service loaded the file again at boot.