I am aware only about nftables based solution:
https://wiki.nftables.org/wiki-nftables/index.php/Mangling_packet_headers
As far as I understand, your case uses "http_port" ipset with ports
other than 80. In this scenario you will need to listen all required
ports on the backend so nftables will just modify src/dst IP addresses
accordingly. Otherwise it is impossible to do this conntrackless.
On 6/17/23 06:22, public1020 wrote:
I have a simple nat configuration to forward certain access to a gateway:
iptables -t nat -A PREROUTING -p tcp -m set --match-set http_port dst,dst -j DNAT --to-destination XXX:80
iptables -t nat -A POSTROUTING -j MASQUERADE
Can I do that without nat? Just trying to avoid the "conntrack table full" issue.
Is there a non-stateful solution?
