Nftables Configuration for NAT using IPsec Tunnel on Raspberry Pi

Nftables Configuration NAT using IPsec Tunnel on Raspberry Pi

In this article, we will discuss how to configure Nftables NAT using an IPsec tunnel on a Raspberry Pi device with two network interfaces. The first network interface (eth0) is connected to a local network, and the second network interface (eth1) is an LTE device that establishes an IPsec tunnel using Strongswan.

Prerequisites

• A Raspberry Pi device with two network interfaces
• A local network with IP address range 10.130.X.0/24
• An LTE device with a public IP address
• Strongswan IPsec software installed on the Raspberry Pi

IPsec Tunnel Configuration

The first step is to configure the IPsec tunnel using Strongswan. Here is an example configuration:

# /etc/ipsec.conf

# basic configuration
config setup
    strictcrlpolicy=no
    uniqueids = no

# connection configuration
conn %default
    keyexchange = ikev2
    ike = aes256gcm16-prfsha384-ecp521!
    esp = aes256gcm16-ecp521!
    dpdaction = clear
    dpddelay = 30s
    dpdtimeout = 120s
    rekey = no

# LTE interface configuration
conn LTE
    left = %defaultroute
    leftid = @raspberrypi
    leftfirewall = yes
    leftsourceip = %config
    right = 
    rightid = 
    rightsourceip = 10.131.0.1/32
    auto = start

In this configuration, the left interface is the default route of the Raspberry Pi, and the right interface is the public IP address of the LTE device. The leftsourceip parameter is set to %config, which means that the source IP address of the left interface will be configured automatically based on the remote endpoint.

Nftables NAT Configuration

Once the IPsec tunnel is established, we need to configure Nftables NAT to allow traffic to flow between the local network and the remote network through the IPsec tunnel.

Here is an example Nftables configuration:

# nft add table nat
# nft add chain nat prerouting { type nat hook prerouting priority 0; }
# nft add chain nat postrouting { type nat hook postrouting priority 100; }

# configure SNAT for traffic leaving the local network
# replace 10.130.0.0/24 with the actual IP address range of your local network
nft add rule nat postrouting masquerade ip saddr 10.130.0.0/24 oif eth1

# configure DNAT for traffic entering the local network
# replace 10.130.0.0/24 with the actual IP address range of your local network
# replace  with the actual IP address range of the remote network
nft add rule nat prerouting dnat to :10.130.0.0/24 iif eth0 oif eth1 ip daddr 

In this configuration, we first create a new table called "nat" and two chains called "prerouting" and "postrouting". We then configure SNAT for traffic leaving the local network by using the masquerade command and specifying the source address range and the outgoing interface.

We also configure DNAT for traffic entering the local network by using the dnat command and specifying the destination address range and the incoming and outgoing interfaces.

• Configure the IPsec tunnel using Strongswan
• Configure Nftables NAT to allow traffic to flow between the local network and the remote network through the IPsec tunnel

References

• Simple Configuration
• Simple NAT rules
• Raspberry Pi Networking