On Sun, 12 Nov 2023 18:31:58 +0100 Rubén Méndez Hernández <rmendezh@xxxxxxxxxxxxxxxx> wrote: > Dear netfilter team. > I'm starting with nftables and trying to set an ssh port forwarding > from my firewall IP 192.168.1.252 to my dmz IP 10.0.0.2. But I get > this error: > ------- > nft -cf nft/test.nft > nft/test.nft:30:62-65: Error: ip or ip6 must be specified with address > for inet tables. > add rule inet nat prerouting iifname $int_ext tcp dport 2222 dnat to 10.0.0.2:22 > ^^^^ The synopsis of the dnat statement is as follows. dnat [[ip | ip6] [ prefix ] to] ADDR_SPEC [:PORT_SPEC] [FLAGS] The square brackets indicate components of syntax that are optional, or optional under certain circumstances. The error message indicates that [ip | ip6] is not optional under the circumstance that your rule is expected to reside in an inet table. Therefore, you must specify "ip" immediately after "dnat". Your nftables version must be out of date because the error message has since been improved. -- Kerin Millar
