Use this mode when the VMs behind the Virtual Router have private IP addresses, and your goal is to enable their internet access through the Virtual Router. This feature enables MASQUERADE in the POSTROUTING iptables chain.

The following figure depicts the basic LAN topology assumed by the module:

            public Network
      ┌───────────────────────
   ┌──┴─┐ (*) NAT
┌──┤eth0├──┐
│  └────┘  │
│  Virtual │
│  Router  │
│  ┌────┐  │
└──┤eth1├──┘
   └─┬──┘
     │   private network (e.g. 192.168.0.0/24)
     └────┬───────────┬────────────┬──────────
       ┌──┴──┐     ┌──┴──┐      ┌──┴──┐
       │ VM1 │     │ VM2 │      │ VM3 │
       └─────┘     └─────┘      └─────┘

The following attributes control the basic configuration for NAT'ing:

• ONEAPP_VNF_NAT4_ENABLED to activate the module
• ONEAPP_VNF_NAT4_INTERFACES_OUT defines the public interface

For example, for the example above simply add:

CONTEXT = [
  ...
  ONEAPP_VNF_NAT4_ENABLED        = "YES",
  ONEAPP_VNF_NAT4_INTERFACES_OUT = "eth0",
  ...
]

Gives:

$ iptables -t nat -vnL NAT4-MASQ
Chain NAT4-MASQ (1 references)
 pkts bytes target     prot opt in     out     source               destination
  782 47944 MASQUERADE  0    --  *      eth0    0.0.0.0/0            0.0.0.0/0

You can define static DNAT port-forwarding rules for the NAT4 module, for example:

CONTEXT = [
  ...
  ONEAPP_VNF_NAT4_PORT_FWD0 = "1.2.3.4:1234:10.11.12.13:4321",
  ONEAPP_VNF_NAT4_PORT_FWD1 = "5.6.7.8:1234:10.11.12.13",
  ONEAPP_VNF_NAT4_PORT_FWD2 = "1234:10.11.12.13:4321",
  ONEAPP_VNF_NAT4_PORT_FWD3 = "2345:10.11.12.13",
  ONEAPP_VNF_NAT4_PORT_FWD4 = "<ETH0_EP0>:1234:10.11.12.13:4321",
  ONEAPP_VNF_NAT4_PORT_FWD5 = "<ETH1_EP0>:4321:10.11.12.13",
  ...
]

The syntax is similar to ssh -L local forwarding, i.e. old_dest:old_port:new_dest:new_port, where old_dest and new_port are optional.