From 65259f4c76c82f90a8c41669b6db7b507f301dde Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 7 Nov 2019 17:34:56 +0100
Subject: [PATCH] add draft of nftables article

---
 .../contents.lr                               | 86 +++++++++++++++++++
 1 file changed, 86 insertions(+)
 create mode 100644 content/u/blog/nftables-magic-redirect-all-ports-to-one-port/contents.lr

diff --git a/content/u/blog/nftables-magic-redirect-all-ports-to-one-port/contents.lr b/content/u/blog/nftables-magic-redirect-all-ports-to-one-port/contents.lr
new file mode 100644
index 0000000..810f5ff
--- /dev/null
+++ b/content/u/blog/nftables-magic-redirect-all-ports-to-one-port/contents.lr
@@ -0,0 +1,86 @@
+title: Firewall magic with nftables: how to redirect all ports to one port
+---
+pub_date: 2019-11-07
+---
+author: ungleich
+---
+twitter_handle: ungleich
+---
+_hidden: yes
+---
+_discoverable: no
+---
+abstract:
+How to redirect traffic from all (tcp/udp) ports to another port.
+And why one would want to do that...
+---
+body:
+
+## The problem
+
+Let's say you have a service running on a specific port, for instance
+[wireguard](https://www.wireguard.com/) on **port 51820**, but you
+would like to accept packets on **any** port and have it received by
+your application.
+
+As you might know we are [big fans of
+nftables](https://ungleich.ch/de/cms/ungleich-blog/2018/08/19/iptables-vs-nftables/),
+so we will use nftables to achieve this goal.
+
+## Why would one want this?
+
+There are a variety of reasons for doing this, including the
+"because we can" case. However at
+[ungleich](https://ungleich.ch) we have a real world use case: We
+provide an [IPv6 VPN](https://ipv6vpn.ch) as a service to our
+customers. This service is based on wireguard and is configured to
+listen on port 51820.
+
+Sometimes networks (like hotels or airports) block or filter
+outgoing traffic and thus prevent our customers to be connected by
+IPv6. Obviously this is not what we or our customers want.
+
+Typically these networks will still allow outgoing traffic on
+*some ports*, but we don't know *which ports*.
+Thus we will enable wireguard on *all ports*. Simple idea, isn't it?
+
+## How it works
+
+To achieve our goal we need to tell nftables to take the traffic that
+goes to any port that is not our target port, to be redirected to our
+target part. If you have other services running on the host, you might
+want to adjust this logic.
+
+In nftables we have a lot of freedom naming and creating our own
+chains
+
+TO FIX HERE
+
+ALSO maybe include only incoming packets modification or is it part of prerouting?!
+
+```
+table ip nat {
+	chain prerouting {
+		type nat hook prerouting priority filter; policy accept;
+		udp dport != 51820 jump vpnredirect
+	}
+
+	chain postrouting {
+		type nat hook postrouting priority srcnat; policy accept;
+	}
+
+	chain vpnredirect {
+		udp dport != 51820 redirect to :51820
+	}
+}
+```
+
+
+## Other programs!
+
+
+## List of sites
+
+You find the current list of sites on
+[via-ipv6.com](https://via-ipv6.com). If you would like to have
+another site added, just ping me on [IPv6.chat](https://IPv6.chat).