{
    "content": [
        {
            "type": "text",
            "text": "# nat (info)\n\n## NAME\n\nnat - stateless native address translation action\n\n## SYNOPSIS\n\ntc ... action nat DIRECTION OLD NEW\nDIRECTION := { ingress | egress }\nOLD := IPV4ADDRSPEC\nNEW := IPV4ADDRSPEC\nIPV4ADDRSPEC := { default | any | all | inaddr[/{prefix|netmask}]\n\n## DESCRIPTION\n\nThe nat action allows to perform NAT without the overhead of conntrack,\nwhich is desirable if the number of flows or addresses to  perform  NAT\non  is large. This action is best used in combination with the u32 fil-\nter to allow for efficient lookups of a large number of  stateless  NAT\nrules in constant time.\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION**\n- **OPTIONS**\n- **NOTES**\n- **SEE ALSO**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n"
        }
    ],
    "structuredContent": {
        "command": "nat",
        "section": "",
        "mode": "info",
        "summary": "nat - stateless native address translation action",
        "synopsis": "tc ... action nat DIRECTION OLD NEW\nDIRECTION := { ingress | egress }\nOLD := IPV4ADDRSPEC\nNEW := IPV4ADDRSPEC\nIPV4ADDRSPEC := { default | any | all | inaddr[/{prefix|netmask}]",
        "tldr_summary": null,
        "tldr_examples": [],
        "tldr_source": null,
        "flags": [],
        "examples": [],
        "see_also": [
            {
                "name": "tc",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/tc/8/json"
            },
            {
                "name": "tc",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/tc/8/json"
            }
        ],
        "section_outline": [
            {
                "name": "NAME",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "SYNOPSIS",
                "lines": 10,
                "subsections": []
            },
            {
                "name": "DESCRIPTION",
                "lines": 6,
                "subsections": []
            },
            {
                "name": "OPTIONS",
                "lines": 9,
                "subsections": []
            },
            {
                "name": "NOTES",
                "lines": 18,
                "subsections": []
            },
            {
                "name": "SEE ALSO",
                "lines": 3,
                "subsections": []
            }
        ],
        "sections": {
            "NAME": {
                "content": "nat - stateless native address translation action\n",
                "subsections": []
            },
            "SYNOPSIS": {
                "content": "tc ... action nat DIRECTION OLD NEW\n\nDIRECTION := { ingress | egress }\n\nOLD := IPV4ADDRSPEC\n\nNEW := IPV4ADDRSPEC\n\nIPV4ADDRSPEC := { default | any | all | inaddr[/{prefix|netmask}]\n",
                "subsections": []
            },
            "DESCRIPTION": {
                "content": "The nat action allows to perform NAT without the overhead of conntrack,\nwhich is desirable if the number of flows or addresses to  perform  NAT\non  is large. This action is best used in combination with the u32 fil-\nter to allow for efficient lookups of a large number of  stateless  NAT\nrules in constant time.\n",
                "subsections": []
            },
            "OPTIONS": {
                "content": "ingress\nTranslate destination addresses, i.e. perform DNAT.\n\negress Translate source addresses, i.e. perform SNAT.\n\nOLD    Specifies addresses which should be translated.\n\nNEW    Specifies addresses which OLD should be translated into.\n",
                "subsections": []
            },
            "NOTES": {
                "content": "The  accepted  address  format in OLD and NEW is quite flexible. It may\neither consist of one of the keywords default, any or all, representing\nthe  all-zero  IP address or a combination of IP address and netmask or\nprefix length separated by a slash (/) sign. In any case, the mask  (or\nprefix  length)  value of OLD is used for NEW as well so that a one-to-\none mapping of addresses is assured.\n\nAddress translation is done using a combination of  binary  operations.\nFirst,  the original (source or destination) address is matched against\nthe value of OLD.  If the original address fits,  the  new  address  is\ncreated  by taking the leading bits from NEW (defined by the netmask of\nOLD) and taking the remaining bits from the original address.\n\nThere is rudimental support for upper layer protocols, namely TCP,  UDP\nand  ICMP.  While for the first two only checksum recalculation is per-\nformed, the action also takes care of embedded IP headers in ICMP pack-\nets by translating the respective address therein, too.\n",
                "subsections": []
            },
            "SEE ALSO": {
                "content": "tc(8)\n\niproute2                          12 Jan 2015              NAT action in tc(8)",
                "subsections": []
            }
        }
    }
}