Greetz, I ran into a problem this morning. I'm currently migrating over from iptables to nftables. My problem is, that I'm running my containers behind nat and I want to forward my ports (e.g. 443, 80) onto my container. There is no error when applying the ruleset below, but I'm not able to get onto my webserver when using nftables.

Thanks in advance for the answers given by you. :^)

Cheers, TheGoliath

My config: (/etc/nftables.conf) https://hastebin.com/poxadagoce.pl

closed as unclear what you're asking by womble Apr 14 at 3:25

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Please make sure any relevant information is in your question, not linked to an external site. Especially since the external site you linked to is broken. – Michael Hampton Feb 4 '18 at 19:22
  • just in case, add the nat output chain even if not used, to rule out a current "bug" not very documented but known for long. eg: marc.info/?l=netfilter&m=152532769025083&w=2 – A.B May 10 '18 at 16:11

Here are some steps you can take:

  1. Type nat hook prerouting priority 0; <-Should be -100 (minus hundred) according to NF_IP_PRI_NAT_DST netfilter constant
  2. Use "meta nftrace set 1" in prerouting and "nft monitor" for debug you packet flow
  3. Simplest ruleset to isolate problem and make example

I also have not working dnat. From one iface all OK but from other not.

Packets enter prerouting, dnat accepted But nothing happens after this. "Conntrac -E" does not see these packages.


Thanks to Роман Иванов for useful nft monitor.

NAT doesn't work because i use this rule at the end of filter forward:

iifname wan0 reject

in chain NAT you need rule:


nft add rule nat prerouting iifname wan0 tcp dport { 80, 443 } dnat  

in chain FILTER you need rule:


nft add rule filter forward iifname wan0 oifname lan0 ip daddr tcp dport { 80, 443 } accept

Not the answer you're looking for? Browse other questions tagged or ask your own question.