Add a generic NAT table: port forward, source NAT, masquerade

router.firewall.nat replaces the dnat/toPort/hairpin fields of the filter
rules. Filter rules gain natOnly, and may use wan with log and rate limit
in the web UI. The Firewall page edits the NAT table and can add the
matching allow rule. Settings schema 1 (migrations/1.jq) converts old
forwards.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

tests/vlans.nix

@@ -9,6 +9,10 @@
 #          iot -> trusted, tcp 9090, only from source ports 40000-40010
 #          "lab" (no interface yet) -> trusted: matches nothing
 #
+#   nat:   trusted -> router:7070 is forwarded to iot:8081 (source kept)
+#          trusted -> iot tcp 8082 is masqueraded (iot sees the router)
+#          trusted -> iot tcp 8083 is source-translated to 192.168.20.1
+#
 #   upstream (ISP) -- vlan 1 -- router -- vlan 2 (trunk) -- main / iot / cams
 { self, pkgs }:
 let
@@ -164,6 +168,32 @@ pkgs.testers.runNixOSTest {
             }
           ];
           firewall.zones = [ "lab" ];
+          firewall.nat = [
+            {
+              type = "dnat";
+              from = "trusted";
+              to = "iot";
+              protocol = "tcp";
+              ports = [ 7070 ];
+              toAddress = "192.168.20.100";
+              toPort = 8081;
+            }
+            {
+              type = "masquerade";
+              from = "trusted";
+              to = "iot";
+              protocol = "tcp";
+              ports = [ 8082 ];
+            }
+            {
+              type = "snat";
+              from = "trusted";
+              to = "iot";
+              protocol = "tcp";
+              ports = [ 8083 ];
+              toAddress = "192.168.20.1";
+            }
+          ];
           dns.forwarders = [ "203.0.113.1" ];
         };
 
@@ -198,7 +228,22 @@ pkgs.testers.runNixOSTest {
         };
       };
 
-    iot = host 20;
+    # Echoes the address it sees, to tell translated connections from plain ones.
+    iot =
+      { ... }:
+      {
+        imports = [ (host 20) ];
+        services.nginx = {
+          enable = true;
+          virtualHosts."ports" = {
+            listen = map (port: {
+              addr = "0.0.0.0";
+              inherit port;
+            }) [ 8081 8082 8083 ];
+            locations."/".return = ''200 "$remote_addr"'';
+          };
+        };
+      };
     cams = host 30;
   };
 
@@ -208,6 +253,7 @@ pkgs.testers.runNixOSTest {
     upstream.wait_for_unit("dnsmasq.service")
     upstream.wait_for_unit("nginx.service")
     main.wait_for_unit("nginx.service")
+    iot.wait_for_unit("nginx.service")
 
     with subtest("router is up with VLAN devices on the trunk"):
         router.wait_for_unit("network-online.target")
@@ -269,6 +315,18 @@ pkgs.testers.runNixOSTest {
             host.fail("nc -z -w 2 -p 50000 192.168.10.100 9090")
             host.fail("nc -z -w 2 -p 40005 192.168.10.150 9090")
 
+    with subtest("a port forward from a LAN keeps the source address"):
+        out = main.succeed("curl -sf --max-time 5 http://192.168.10.1:7070/").strip()
+        assert out == "192.168.10.100", out
+        # Not addressed to the router: not forwarded.
+        main.fail("curl -sf --max-time 3 http://192.168.10.1:7071/")
+
+    with subtest("masquerade and source NAT rewrite the source between zones"):
+        assert main.succeed("curl -sf --max-time 5 http://192.168.20.100:8081/").strip() == "192.168.10.100"
+        assert main.succeed("curl -sf --max-time 5 http://192.168.20.100:8082/").strip() == "192.168.20.1"
+        assert main.succeed("curl -sf --max-time 5 http://192.168.20.100:8083/").strip() == "192.168.20.1"
+        router.succeed("nft list ruleset | grep -q 'snat to 192.168.20.1'")
+
     with subtest("a zone without interfaces does not break the ruleset"):
         router.succeed("nft list ruleset | grep -q 'sport 40000-40010'")
         router.succeed("systemctl is-active nftables.service")