T160: add NAT64

[sever-sever]

Change Summary

Add NAT64 feature

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T160

Related PR(s)

Component(s) name

Proposed changes

How to test

Add a separate address 192.168.122.10, only for nat64 translations
NAT64-server

set interfaces ethernet eth0 address '192.168.122.14/24'
set interfaces ethernet eth0 address '192.168.122.10/24'
set interfaces ethernet eth2 address '2001:db8::1/64'

set nat64 source rule 100 source prefix '64:ff9b::/96'
set nat64 source rule 100 translation pool 10 address '192.168.122.10'
set nat64 source rule 100 translation pool 10 port '1-65535'

Check Jool instance:

vyos@r4# sudo jool instance display
+--------------------+-----------------+-----------+
|          Namespace |            Name | Framework |
+--------------------+-----------------+-----------+
|           bf9ee1c0 |    instance-100 | netfilter |
+--------------------+-----------------+-----------+
[edit]
vyos@r4# 

Check Jool config instance

vyos@r4# cat /run/jool/instance-100.json 
{
  "instance": "instance-100",
  "framework": "netfilter",
  "global": {
    "pool6": "64:ff9b::/96",
    "manually-enabled": true
  },
  "pool4": [
    {
      "protocol": "TCP",
      "prefix": "192.168.122.10",
      "port range": "1-65535"
    },
    {
      "protocol": "UDP",
      "prefix": "192.168.122.10",
      "port range": "1-65535"
    },
    {
      "protocol": "ICMP",
      "prefix": "192.168.122.10",
      "port range": "1-65535"
    }
  ]
}[edit]
vyos@r4# 

From the IPv6 only host 2001:db8::2 try to ping IPv4 hosts:

vyos@r12:~$ show int
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface        IP Address                        S/L  Description
---------        ----------                        ---  -----------
eth0             -                                 u/u  
eth1             2001:db8::2/64                    u/u  
lo               127.0.0.1/8                       u/u  
                 ::1/128
vyos@r12:~$ 
vyos@r12:~$ show ipv6 route 
S>* ::/0 [1/0] via 2001:db8::1, eth1, 00:20:30
C>* 2001:db8::/64 is directly connected, eth1, 00:20:31
vyos@r12:~$ 
vyos@r12:~$ 
vyos@r12:~$ 
vyos@r12:~$ ping 64:ff9b::1.1.1.1 count 2
PING 64:ff9b::1.1.1.1(64:ff9b::101:101) 56 data bytes
64 bytes from 64:ff9b::101:101: icmp_seq=1 ttl=58 time=20.0 ms
64 bytes from 64:ff9b::101:101: icmp_seq=2 ttl=58 time=20.0 ms

--- 64:ff9b::1.1.1.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 20.087/20.090/20.093/0.003 ms
vyos@r12:~$ 

DUMP from the NAT64 host:

vyos@r4# sudo tcpdump -nti eth0 host 1.1.1.1
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
IP 192.168.122.10 > 1.1.1.1: ICMP echo request, id 28656, seq 1, length 64
IP 1.1.1.1 > 192.168.122.10: ICMP echo reply, id 28656, seq 1, length 64
IP 192.168.122.10 > 1.1.1.1: ICMP echo request, id 28656, seq 2, length 64
IP 1.1.1.1 > 192.168.122.10: ICMP echo reply, id 28656, seq 2, length 64

Smoketest result

vyos@r4:~$ /usr/libexec/vyos/tests/smoke/cli/test_nat64.py
test_snat64 (__main__.TestNAT64.test_snat64) ... ok

----------------------------------------------------------------------
Ran 1 test in 3.679s

OK
vyos@r4:~$ 

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[sever-sever]

@Mergifyio backport sagitta

[mergify]

backport sagitta

✅ Backports have been created

• #2581 T160: add NAT64 (backport #2578) has been created for branch sagitta but encountered conflicts