如果我想进行 fullcone 和 nat66，CLI 方式启动应该怎么使用？

[sbwml]

我的网口信息：

wan：eth0 （DHCP）
wan6：eth0 （DHCPv6）

br-lan：eth1、eth2（网桥设备）

当我尝试执行：

./einat --ifname eth0 --hairpin-if lo br-lan

得到信息：

2024-04-07T23:13:03.097784Z  INFO einat::instance: eBPF programs loaded in 413.531545ms
2024-04-07T23:13:03.097904Z  INFO einat::instance: setting default external IPv4 address 192.168.50.115
2024-04-07T23:13:03.097935Z  INFO einat::instance: no default external IPv6 address set, NAT66 disabled
2024-04-07T23:13:03.098207Z  WARN einat: libbpf: Kernel error message: Exclusivity flag on, cannot modify

fullcone 没有工作。

[sbwml]

PS：我的网络环境应该没有问题，因为在传统的 nft-fullcone 或者 bcm-fullcone 中，NAT1 都是工作的。

[EHfive]

Read the documentation please.

https://github.com/EHfive/einat-ebpf#usage

https://github.com/EHfive/einat-ebpf/blob/main/docs/guide/openwrt.md#nat-setup

Specify both --nat44 and --nat66 flag if you want to enable both NAPT44 and NAPT66.

It's likely you had nftables/iptables IP masquerading remain active, disable IP masquerading otherwise einat would not be able to perform EI NAT as traffic was already NATed in Netfilter.

Also we only accept issues in English.

[EHfive]

It could also be your firewall is blocking inbound traffic, make sure the external ports that NAT einat uses(defaults to 20000-29999) is open and forwarded in inbound direction on NAT host.

[sbwml]

It could also be your firewall is blocking inbound traffic, make sure the external ports that NAT einat uses(defaults to 20000-29999) is open and forwarded in inbound direction on NAT host.

I tried allowing all traffic in the firewall and increasing the port range, but it didn't have the expected effect.

[root@OpenWrt ~]# ./einat --ifname eth0 --hairpin-if lo br-lan --ports 2000-60000 --bpf-log 5
2024-04-08T17:10:15.511119Z  INFO einat::instance: eBPF programs loaded in 506.026691ms
2024-04-08T17:10:15.511236Z  INFO einat::instance: setting default external IPv4 address 192.168.50.115
2024-04-08T17:10:15.511267Z  INFO einat::instance: no default external IPv6 address set, NAT66 disabled
^C[root@OpenWrt ~]#

[EHfive]

It's likely you had nftables/iptables IP masquerading remain active, disable IP masquerading otherwise einat would not be able to perform EI NAT as traffic was already NATed in Netfilter.

Uncheck the "Masquerading" for WAN zone..

[sbwml]

Indeed, now it works.

[muink]

libbpf: Kernel error message: Exclusivity flag on, cannot modify is it harmless and can be ignored?

[EHfive]

It's harmless and can be safely ignored.

I would try to filter that message out to avoid confusion.