Configure nftables NAT and port forwarding for home lab environments

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Global variables
SCRIPT_NAME="nftables-nat-setup"
BACKUP_DIR="/tmp/${SCRIPT_NAME}-backup-$(date +%s)"

# Usage message
usage() {
    cat << EOF
Usage: $0 [OPTIONS]
Configure nftables NAT and port forwarding for home lab environments

OPTIONS:
    -w, --wan-if INTERFACE      WAN interface name (default: auto-detect)
    -l, --lan-if INTERFACE      LAN interface name (default: auto-detect)
    -n, --lan-net NETWORK       LAN network CIDR (default: 192.168.1.0/24)
    -L, --lab-net NETWORK       Lab network CIDR (default: 10.0.0.0/24)
    -h, --help                  Show this help message

Example:
    $0 --wan-if enp0s3 --lan-if enp0s8 --lan-net 192.168.100.0/24
EOF
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function
cleanup() {
    if [[ -d "$BACKUP_DIR" ]]; then
        log_warn "Script failed. Restoring from backup..."
        if [[ -f "$BACKUP_DIR/nftables.conf" ]]; then
            cp "$BACKUP_DIR/nftables.conf" /etc/nftables.conf 2>/dev/null || true
        fi
        if [[ -f "$BACKUP_DIR/sysctl.conf" ]]; then
            cp "$BACKUP_DIR/sysctl.conf" /etc/sysctl.conf 2>/dev/null || true
        fi
        systemctl reload nftables 2>/dev/null || true
        sysctl -p 2>/dev/null || true
    fi
}

trap cleanup ERR

# Check prerequisites
check_prerequisites() {
    echo "[1/8] Checking prerequisites..."
    
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root"
        exit 1
    fi
    
    if ! command -v systemctl &> /dev/null; then
        log_error "systemd is required"
        exit 1
    fi
}

# Detect distribution and package manager
detect_distro() {
    echo "[2/8] Detecting distribution..."
    
    if [[ ! -f /etc/os-release ]]; then
        log_error "Cannot detect distribution - /etc/os-release not found"
        exit 1
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            PKG_UPGRADE="apt upgrade -y"
            FIREWALL_SERVICE="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            PKG_UPGRADE="dnf upgrade -y"
            FIREWALL_SERVICE="firewalld"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            PKG_UPGRADE="dnf upgrade -y"
            FIREWALL_SERVICE="firewalld"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum check-update || true"
            PKG_INSTALL="yum install -y"
            PKG_UPGRADE="yum upgrade -y"
            FIREWALL_SERVICE="iptables"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    log_info "Detected: $PRETTY_NAME using $PKG_MGR"
}

# Parse command line arguments
parse_args() {
    WAN_IF=""
    LAN_IF=""
    LAN_NET="192.168.1.0/24"
    LAB_NET="10.0.0.0/24"
    
    while [[ $# -gt 0 ]]; do
        case $1 in
            -w|--wan-if) WAN_IF="$2"; shift 2 ;;
            -l|--lan-if) LAN_IF="$2"; shift 2 ;;
            -n|--lan-net) LAN_NET="$2"; shift 2 ;;
            -L|--lab-net) LAB_NET="$2"; shift 2 ;;
            -h|--help) usage ;;
            *) log_error "Unknown option: $1"; usage ;;
        esac
    done
}

# Auto-detect network interfaces
detect_interfaces() {
    if [[ -z "$WAN_IF" ]]; then
        WAN_IF=$(ip route | grep default | head -1 | awk '{print $5}')
        log_info "Auto-detected WAN interface: $WAN_IF"
    fi
    
    if [[ -z "$LAN_IF" ]]; then
        LAN_IF=$(ip link show | grep -E '^[0-9]+:' | grep -v lo | grep -v "$WAN_IF" | head -1 | cut -d: -f2 | tr -d ' ')
        log_info "Auto-detected LAN interface: $LAN_IF"
    fi
    
    if [[ -z "$WAN_IF" || -z "$LAN_IF" ]]; then
        log_error "Could not detect network interfaces. Please specify them manually."
        exit 1
    fi
}

# Install and update packages
install_packages() {
    echo "[3/8] Installing nftables..."
    
    mkdir -p "$BACKUP_DIR"
    
    $PKG_UPDATE
    $PKG_INSTALL nftables
    
    log_info "nftables installed successfully"
}

# Stop conflicting services
stop_conflicting_services() {
    echo "[4/8] Stopping conflicting firewall services..."
    
    local services=("$FIREWALL_SERVICE" "iptables")
    
    for service in "${services[@]}"; do
        if systemctl is-active --quiet "$service" 2>/dev/null; then
            log_info "Stopping $service"
            systemctl stop "$service"
        fi
        if systemctl is-enabled --quiet "$service" 2>/dev/null; then
            log_info "Disabling $service"
            systemctl disable "$service"
        fi
    done
}

# Enable IP forwarding
enable_ip_forwarding() {
    echo "[5/8] Enabling IP forwarding..."
    
    [[ -f /etc/sysctl.conf ]] && cp /etc/sysctl.conf "$BACKUP_DIR/"
    
    if ! grep -q "net.ipv4.ip_forward = 1" /etc/sysctl.conf; then
        echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
    fi
    
    if ! grep -q "net.ipv6.conf.all.forwarding = 1" /etc/sysctl.conf; then
        echo 'net.ipv6.conf.all.forwarding = 1' >> /etc/sysctl.conf
    fi
    
    sysctl -p
    log_info "IP forwarding enabled"
}

# Create nftables configuration
create_nftables_config() {
    echo "[6/8] Creating nftables configuration..."
    
    [[ -f /etc/nftables.conf ]] && cp /etc/nftables.conf "$BACKUP_DIR/"
    
    cat > /etc/nftables.conf << EOF
#!/usr/sbin/nft -f

# Clear existing rules
flush ruleset

# Define variables for interfaces and networks
define WAN_IF = "$WAN_IF"
define LAN_IF = "$LAN_IF"
define LAN_NET = "$LAN_NET"
define HOMELAB_NET = "$LAB_NET"

# Main filter table
table inet filter {
    chain input {
        type filter hook input priority filter
        policy drop
        
        iif lo accept
        ct state established,related accept
        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept
        
        iifname { \$LAN_IF } ip saddr { \$LAN_NET, \$HOMELAB_NET } tcp dport 22 accept
        iifname { \$LAN_IF } ip saddr { \$LAN_NET, \$HOMELAB_NET } udp dport 53 accept
        iifname { \$LAN_IF } ip saddr { \$LAN_NET, \$HOMELAB_NET } tcp dport 53 accept
        
        counter drop
    }
    
    chain forward {
        type filter hook forward priority filter
        policy drop
        
        ct state established,related accept
        iifname \$LAN_IF oifname \$WAN_IF ip saddr \$LAN_NET accept
        iifname \$LAN_IF oifname \$WAN_IF ip saddr \$HOMELAB_NET accept
        iifname \$LAN_IF oifname \$LAN_IF ip saddr { \$LAN_NET, \$HOMELAB_NET } ip daddr { \$LAN_NET, \$HOMELAB_NET } accept
        
        counter drop
    }
    
    chain output {
        type filter hook output priority filter
        policy accept
    }
}

# NAT table
table inet nat {
    chain prerouting {
        type nat hook prerouting priority dstnat
    }
    
    chain postrouting {
        type nat hook postrouting priority srcnat
        
        oifname \$WAN_IF ip saddr { \$LAN_NET, \$HOMELAB_NET } masquerade
    }
}
EOF

    chmod 644 /etc/nftables.conf
    log_info "nftables configuration created"
}

# Enable and start services
enable_services() {
    echo "[7/8] Enabling nftables service..."
    
    systemctl enable nftables
    systemctl restart nftables
    
    log_info "nftables service enabled and started"
}

# Verify configuration
verify_setup() {
    echo "[8/8] Verifying setup..."
    
    if ! systemctl is-active --quiet nftables; then
        log_error "nftables service is not running"
        exit 1
    fi
    
    if ! sysctl net.ipv4.ip_forward | grep -q "= 1"; then
        log_error "IP forwarding is not enabled"
        exit 1
    fi
    
    if ! nft list tables | grep -q "inet filter"; then
        log_error "nftables filter table not found"
        exit 1
    fi
    
    if ! nft list tables | grep -q "inet nat"; then
        log_error "nftables NAT table not found"
        exit 1
    fi
    
    log_info "Setup verification completed successfully"
    log_info "NAT and port forwarding configured for:"
    log_info "  WAN Interface: $WAN_IF"
    log_info "  LAN Interface: $LAN_IF" 
    log_info "  LAN Network: $LAN_NET"
    log_info "  Lab Network: $LAB_NET"
    log_info ""
    log_info "To add port forwarding rules, edit /etc/nftables.conf"
    log_info "Example: iifname \$WAN_IF tcp dport 8080 dnat to 10.0.0.10:80"
}

# Main execution
main() {
    parse_args "$@"
    check_prerequisites
    detect_distro
    detect_interfaces
    install_packages
    stop_conflicting_services
    enable_ip_forwarding
    create_nftables_config
    enable_services
    verify_setup
}

main "$@"