Render the NAT tier into per-device configs #6

2026-07-21T22:19:20+10:00

unkinben commented

2026-07-21 22:19:20 +10:00

Why

The NAT tier (snat/masquerade, netmap, 1:1 nat) was stored and terraformable but never compiled into the per-device configs agents apply. This projects it through bindings so it actually takes effect.

Changes

Add RenderedSNAT / RenderedNetmap / RenderedNAT to the rendered config; fetch the tiers in Compile.
snat/masquerade renders on devices that bind the egress zone (and, for a zone source, that zone too), resolving the egress interface — auto-scoping masquerade to edges; a literal-CIDR source needs only the egress binding.
netmap renders on the device its anchor (device:zone|interface) names, resolving a zone anchor to its bound interface.
1:1 nat renders on the device it is bound to.
Unit tests cover edge-vs-interior scoping and other-device exclusion.

Pairs with

A tomswall PR maps these rendered NAT sections into native config (SNAT/Netmap/StaticNAT) in the agent's Translate.

## Why The NAT tier (snat/masquerade, netmap, 1:1 nat) was stored and terraformable but never compiled into the per-device configs agents apply. This projects it through bindings so it actually takes effect. ## Changes - Add RenderedSNAT / RenderedNetmap / RenderedNAT to the rendered config; fetch the tiers in Compile. - snat/masquerade renders on devices that bind the egress zone (and, for a zone source, that zone too), resolving the egress interface — auto-scoping masquerade to edges; a literal-CIDR source needs only the egress binding. - netmap renders on the device its anchor (device:zone|interface) names, resolving a zone anchor to its bound interface. - 1:1 nat renders on the device it is bound to. - Unit tests cover edge-vs-interior scoping and other-device exclusion. ## Pairs with A tomswall PR maps these rendered NAT sections into native config (SNAT/Netmap/StaticNAT) in the agent's Translate.

unkinben added 1 commit 2026-07-21 22:19:20 +10:00

Render the NAT tier into per-device configs

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

335c61383a

The compiler now projects the global NAT intents through each device's bindings
into the rendered config:
- snat/masquerade: renders on a device that binds the egress zone (and, when the
  source is a zone, that zone too), resolving the egress interface — this
  auto-scopes masquerade to edge devices. A literal-CIDR source needs only the
  egress binding.
- netmap: renders on the device its anchor (device:zone|interface) names,
  resolving a zone anchor to its bound interface.
- 1:1 nat: renders on the device it is bound to.
Adds RenderedSNAT/RenderedNetmap/RenderedNAT to the rendered config, fetches the
tiers in Compile, and unit-tests binding-scoping (edge vs interior/other device).

benvin merged commit dc3b2ecdb9 into main

2026-07-21 22:30:01 +10:00

benvin deleted branch benvin/render-nat

2026-07-21 22:30:02 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/tomswallapi#6