op mode: T6348: SNAT op-mode fails with flowtable offload entries

[natali-rs1985]

Change Summary

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T6348

Related PR(s)

Component(s) name

nat

Proposed changes

How to test

set firewall flowtable OFFLOAD interface 'eth0'
set firewall flowtable OFFLOAD interface 'eth1'
set firewall flowtable OFFLOAD offload 'software'

set firewall ipv4 forward filter default-action 'accept'
set firewall ipv4 forward filter rule 5 action 'offload'
set firewall ipv4 forward filter rule 5 offload-target 'OFFLOAD'
set firewall ipv4 forward filter rule 5 state 'established'
set firewall ipv4 forward filter rule 5 state 'related'

set nat cgnat pool external ext01 external-port-range '1024-65535'
set nat cgnat pool external ext01 per-user-limit port '2000'
set nat cgnat pool external ext01 range 192.168.122.222/32
set nat cgnat pool internal int01 range '100.64.0.0/28'
set nat cgnat rule 10 source pool 'int01'
set nat cgnat rule 10 translation pool 'ext01'

set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '10.0.0.0/24'
set nat source rule 100 translation address 'masquerade'

vyos@vyos# run show nat source translations
Pre-NAT           Post-NAT              Proto    Timeout    Mark    Zone
----------------  --------------------  -------  ---------  ------  ------
100.64.0.1:44704  192.168.122.222:4709  udp      27         0
100.64.0.1:47889  192.168.122.222:4038  udp      n/a         0

Smoketest result

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[sever-sever]

@Mergifyio backport sagitta

[mergify]

backport sagitta

✅ Backports have been created

• #3478 op mode: T6348: SNAT op-mode fails with flowtable offload entries (backport #3471) has been created for branch sagitta