Source NAT not working on AlmaLinux 8.10

Support
1

I’m struggling with setting source NAT(SNAT) on my newly installed AlmaLinux server(8.10, installed by the VPS provider.
I hope this server serve as a router which can forward all my vpn traffic to public network.

There is two network interface on it :
eth0 – ISP network with a static IP a.b.c.d
sh – vpn on this server with IP 192.168.0.1

My setting process:

  1. enable kernel forwarding:

vim /etc/sysctl.conf
net.ipv4.ip_forward=1
sysctl -p

  1. set Firewalld:
    assign interface to zones

firewall-cmd --zone=public --add-interface=eth0 --permanent
firewall-cmd --zone=trusted --add-interface=sh --permanent

allow forward

firewall-cmd --zone=public --add-forward --permanent

I’ve tried both all source masquerade and specific source masquerade

firewall-cmd --zone=public --add-masquerade --permanent
firewall-cmd --zone=public --add-rich-rule=‘rule family=“ipv4” source address=“192.168.0.0/24” masquerade’ --permanent

reload firewalld

firewall-cmd --complete-reload

output of firewall-cmd --list-all-zones

public (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: eth0
sources:
services: cockpit dhcpv6-client ssh
ports: ***
protocols:
forward: yes
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family=“ipv4” source address=“192.168.0.0/24” masquerade
rule family=“ipv4” source address=“8.8.8.8” port port=“53” protocol=“udp” accept
rule family=“ipv4” source address=“8.8.8.8” port port=“53” protocol=“tcp” accept

trusted (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: sh
sources:
services:
ports: ***
protocols:
forward: no
masquerade: no
forward-ports:
port=53:proto=tcp:toport=53:toaddr=8.8.8.8
port=53:proto=udp:toport=53:toaddr=8.8.8.8
source-ports:
icmp-blocks:
rich rules:

The SNAT still not work on my server.
I’ve ping the server from other node like 192.168.0.2 and reversely, both of them works pretty good. So the vpn network is fine and other firewalld port-forward setting(port 53) on this server works too. I don’t know what is wrong. Could anyone help me please?

2 
nft list ruleset

Shows the current ruleset. Does it have masquerade rules?

If you pretend to be a packet that enters type filter hook forward chain, where do you end up?

3

Thanks for your help. The “masqurade” related output of nft is:

table ip nat {
    chain PREROUTING {
            type nat hook prerouting priority dstnat; policy accept;
    }

    chain INPUT {
            type nat hook input priority 100; policy accept;
    }

    chain POSTROUTING {
            type nat hook postrouting priority srcnat; policy accept;
            oifname "eth0" ip saddr 192.168.0.0/24 counter packets 5 bytes 300 masquerade 
    }

    chain OUTPUT {
            type nat hook output priority -100; policy accept;
    }
}
......
    chain nat_POST_public_allow {
            oifname != "lo" masquerade
            ip saddr 192.168.0.0/24 oifname != "lo" masquerade
    }
4

After the frustrated check work, the problem was caused by my private net(vpn) setting, but not firewalld.