{"id":42042802,"url":"https://github.com/h3nr1-d14z/nat-gate","last_synced_at":"2026-02-01T17:00:49.364Z","repository":{"id":334647254,"uuid":"1142183003","full_name":"h3nr1-d14z/nat-gate","owner":"h3nr1-d14z","description":"CLI tool for managing iptables port forwarding through Tailscale tunnels","archived":false,"fork":false,"pushed_at":"2026-01-28T11:17:34.000Z","size":316,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-01-29T02:16:36.448Z","etag":null,"topics":["cli","iptables","linux","nat","networking","port-forwarding","rust","tailscale"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/h3nr1-d14z.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-01-26T03:56:36.000Z","updated_at":"2026-01-28T11:17:34.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/h3nr1-d14z/nat-gate","commit_stats":null,"previous_names":["h3nr1-d14z/nat-gate"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/h3nr1-d14z/nat-gate","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h3nr1-d14z%2Fnat-gate","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h3nr1-d14z%2Fnat-gate/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h3nr1-d14z%2Fnat-gate/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h3nr1-d14z%2Fnat-gate/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/h3nr1-d14z","download_url":"https://codeload.github.com/h3nr1-d14z/nat-gate/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h3nr1-d14z%2Fnat-gate/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28879012,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-29T10:31:27.438Z","status":"ssl_error","status_checked_at":"2026-01-29T10:31:01.017Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","iptables","linux","nat","networking","port-forwarding","rust","tailscale"],"created_at":"2026-01-26T06:00:47.334Z","updated_at":"2026-01-29T14:03:54.831Z","avatar_url":"https://github.com/h3nr1-d14z.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# nat-gate\n\nA CLI tool for managing iptables port forwarding through Tailscale tunnels.\n\n**nat-gate** makes it easy to expose services running on your Tailscale network to the public internet through a gateway server. Perfect for:\n- Exposing web servers behind NAT\n- Running game servers accessible from anywhere\n- Sharing development environments\n\n## Installation\n\n### curl | bash (Recommended)\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/h3nr1-d14z/nat-gate/master/scripts/install.sh | bash\n```\n\n### npm\n\n```bash\nnpm install -g @h3nr1-d14z/nat-gate\n```\n\n### Docker\n\n```bash\ndocker run --rm --cap-add=NET_ADMIN --network=host \\\n  ghcr.io/h3nr1-d14z/nat-gate list\n```\n\n### Homebrew (Linux)\n\n```bash\nbrew install h3nr1-d14z/tap/nat-gate\n```\n\n### Arch Linux (AUR)\n\n```bash\nyay -S nat-gate\n```\n\n### From Source\n\n```bash\ncargo install --git https://github.com/h3nr1-d14z/nat-gate\n```\n\n## Quick Start\n\n1. **Initialize your system** (enables IP forwarding, checks dependencies):\n\n```bash\nsudo nat-gate init\n```\n\n2. **Add a forwarding rule** (forward TCP port 443 to Tailscale IP 100.64.0.5):\n\n```bash\nsudo nat-gate add tcp 443 100.64.0.5\n```\n\n3. **List active rules**:\n\n```bash\nsudo nat-gate list\n```\n\n4. **Remove a rule**:\n\n```bash\nsudo nat-gate del tcp 443\n```\n\n5. **Check system status**:\n\n```bash\nnat-gate status\n```\n\n## Commands\n\n| Command | Description |\n|---------|-------------|\n| `nat-gate init` | Initialize system for port forwarding |\n| `nat-gate add \u003ctcp\\|udp\u003e \u003cport\u003e \u003ctarget_ip\u003e` | Add a forwarding rule |\n| `nat-gate del \u003ctcp\\|udp\u003e \u003cport\u003e` | Delete a forwarding rule |\n| `nat-gate list` | List all managed rules |\n| `nat-gate status` | Show system status and rule summary |\n| `nat-gate flush` | Remove all nat-gate managed rules |\n| `nat-gate check` | Health check for rules and connectivity |\n| `nat-gate stats` | Show traffic statistics per rule |\n| `nat-gate backup [file]` | Export rules to JSON backup |\n| `nat-gate restore \u003cfile\u003e` | Import rules from JSON backup |\n| `nat-gate apply` | Apply rules from YAML config file |\n| `nat-gate tailscale` | List available Tailscale peers |\n| `nat-gate completions \u003cshell\u003e` | Generate shell completions |\n| `nat-gate service \u003cinstall\\|uninstall\\|status\u003e` | Manage systemd service |\n| `nat-gate tui` | Launch interactive terminal UI |\n\n### Global Flags\n\n| Flag | Description |\n|------|-------------|\n| `--dry-run` | Preview changes without executing |\n| `--json` | Output in JSON format for scripting |\n\n### Command Options\n\n| Flag | Description |\n|------|-------------|\n| `-6, --ipv6` | Use IPv6 (ip6tables) instead of IPv4 |\n| `-i, --interface \u003ciface\u003e` | Limit rule to specific interface (e.g., eth0) |\n| `--limit \u003crate\u003e` | Rate limit connections (e.g., 100/min, 10/sec) |\n| `-c, --config \u003cfile\u003e` | Specify config file path (for `apply` command) |\n\n## Features\n\n### Port Ranges\n\nForward a range of ports at once:\n\n```bash\n# Forward ports 8000-8080 to target\nsudo nat-gate add tcp 8000-8080 100.64.0.5\n```\n\n### Rate Limiting\n\nProtect your services from abuse with rate limiting:\n\n```bash\n# Limit to 100 connections per minute\nsudo nat-gate add tcp 443 100.64.0.5 --limit 100/min\n\n# Limit to 10 connections per second\nsudo nat-gate add tcp 80 100.64.0.5 --limit 10/sec\n```\n\nSupported units: `sec`, `min`, `hour`, `day`\n\n### IPv6 Support\n\nUse the `-6` flag for IPv6 forwarding:\n\n```bash\n# Initialize with IPv6 support\nsudo nat-gate init -6\n\n# Add IPv6 forwarding rule\nsudo nat-gate add -6 tcp 443 fd7a:115c:a1e0::1\n\n# List IPv6 rules\nsudo nat-gate list -6\n```\n\n### Interface Selection\n\nLimit forwarding to a specific network interface:\n\n```bash\n# Only forward traffic arriving on eth0\nsudo nat-gate add tcp 443 100.64.0.5 -i eth0\n```\n\n### Flush All Rules\n\nRemove all nat-gate managed rules at once:\n\n```bash\n# Remove all IPv4 rules\nsudo nat-gate flush\n\n# Remove all IPv6 rules\nsudo nat-gate flush -6\n\n# Preview what would be removed\nnat-gate --dry-run flush\n```\n\n### Health Check\n\nVerify your forwarding configuration is working:\n\n```bash\n# Check all rules\nsudo nat-gate check\n\n# Test a specific port\nsudo nat-gate check --port 443\n```\n\nOutput:\n```\nChecking nat-gate configuration...\n  IP forwarding (IPv4): OK\n  IP forwarding (IPv6): OK\n\n  IPv4 Rule Health:\n    tcp:443 -\u003e 100.64.0.5: OK (target reachable)\n    tcp:80 -\u003e 100.64.0.5: OK (target reachable)\n    udp:51820 -\u003e 100.64.0.10: WARN (target unreachable)\n\nAll checks passed!\n```\n\n### Traffic Statistics\n\nView packet and byte counts per rule:\n\n```bash\nsudo nat-gate stats\n```\n\nOutput:\n```\nRule Statistics (IPv4):\n------------------------------------------------------------\n Protocol    Port       Target          Packets     Bytes\n------------------------------------------------------------\n    tcp      443     100.64.0.5          1,234    2.1 MB\n    tcp       80     100.64.0.5            567    128 KB\n------------------------------------------------------------\n   TOTAL                                 1,801    2.2 MB\n\nTotal: 2 rule(s), 1,801 packets, 2.2 MB\n```\n\n### Shell Completions\n\nGenerate completions for your shell:\n\n```bash\n# Bash\nnat-gate completions bash \u003e /etc/bash_completion.d/nat-gate\n\n# Zsh\nnat-gate completions zsh \u003e ~/.zfunc/_nat-gate\n\n# Fish\nnat-gate completions fish \u003e ~/.config/fish/completions/nat-gate.fish\n```\n\n### Systemd Service\n\nInstall nat-gate as a systemd service to automatically apply rules on boot:\n\n```bash\n# Install and enable the service\nsudo nat-gate service install\n\n# Check service status\nsudo nat-gate service status\n\n# Uninstall the service\nsudo nat-gate service uninstall\n```\n\nThe service reads rules from `~/.config/nat-gate/rules.yaml` or `/etc/nat-gate/rules.yaml`.\n\n### Interactive TUI Mode\n\nLaunch an interactive terminal interface for managing rules:\n\n```bash\nsudo nat-gate tui\n```\n\nThe TUI provides:\n- **Rules list** with real-time traffic statistics\n- **Add rules** with Tailscale peer picker\n- **Delete rules** with confirmation\n- **Auto-refresh** statistics every 5 seconds\n- **IPv4/IPv6 toggle**\n\n**Key Bindings:**\n\n| Key | Action |\n|-----|--------|\n| `↑`/`k` | Move selection up |\n| `↓`/`j` | Move selection down |\n| `a` | Add new rule |\n| `d`/`Delete` | Delete selected rule |\n| `f` | Flush all rules |\n| `r` | Refresh data |\n| `6` | Toggle IPv4/IPv6 mode |\n| `?`/`h` | Show help |\n| `q`/`Esc` | Quit / Close modal |\n\n**Add Rule Form:**\n- Use `Tab` to navigate between fields\n- Press `Enter` on Target field to open Tailscale peer picker\n- Press `Space` on Protocol field to toggle TCP/UDP\n\n### Dry Run Mode\n\nPreview changes without executing them:\n\n```bash\n# See what would happen\nnat-gate --dry-run add tcp 443 100.64.0.5\n\n# Preview in JSON format\nnat-gate --dry-run --json add tcp 443 100.64.0.5\n```\n\n### JSON Output\n\nGet machine-readable output for scripting:\n\n```bash\n# List rules as JSON\nsudo nat-gate --json list\n\n# Get status as JSON\nnat-gate --json status\n\n# Get stats as JSON\nsudo nat-gate --json stats\n```\n\n### Backup \u0026 Restore\n\nSave and restore your rules:\n\n```bash\n# Backup all rules to a file\nsudo nat-gate backup my-rules.json\n\n# Restore rules (with preview)\nnat-gate --dry-run restore my-rules.json\n\n# Actually restore\nsudo nat-gate restore my-rules.json\n```\n\n### Config File\n\nDefine rules in a YAML config file:\n\n```yaml\n# ~/.config/nat-gate/rules.yaml\nrules:\n  - protocol: tcp\n    port: 443\n    target: 100.64.0.5\n  - protocol: tcp\n    port: 8000-8080\n    target: 100.64.0.5\n    interface: eth0\n  - protocol: udp\n    port: 51820\n    target: 100.64.0.10\n```\n\nApply the config:\n\n```bash\n# Apply from default location\nsudo nat-gate apply\n\n# Apply from specific file\nsudo nat-gate apply -c /path/to/rules.yaml\n\n# Preview first\nnat-gate --dry-run apply\n```\n\n### Tailscale Integration\n\nList available Tailscale peers and their IPs:\n\n```bash\nnat-gate tailscale\n```\n\nOutput:\n```\nTailscale Peers:\n\n  HOSTNAME          IPv4              IPv6              STATUS\n  ─────────────────────────────────────────────────────────────\n  my-server         100.64.0.5        fd7a:115c:...     online\n  raspberry-pi      100.64.0.10       fd7a:115c:...     online\n  laptop            100.64.0.15       -                 offline\n\nTotal: 3 peer(s)\n```\n\n### System Status\n\nCheck your system's forwarding configuration:\n\n```bash\nnat-gate status\n```\n\nThis shows:\n- IP forwarding status (IPv4/IPv6)\n- iptables installation status\n- Active rule counts\n- Network interfaces\n\n## Docker Usage\n\nRun nat-gate in a Docker container:\n\n```bash\n# Show help\ndocker run --rm ghcr.io/h3nr1-d14z/nat-gate --help\n\n# List rules (requires host network and NET_ADMIN capability)\ndocker run --rm --cap-add=NET_ADMIN --network=host \\\n  ghcr.io/h3nr1-d14z/nat-gate list\n\n# Add a rule\ndocker run --rm --cap-add=NET_ADMIN --network=host \\\n  ghcr.io/h3nr1-d14z/nat-gate add tcp 443 100.64.0.5\n\n# Use with config file\ndocker run --rm --cap-add=NET_ADMIN --network=host \\\n  -v /path/to/rules.yaml:/etc/nat-gate/rules.yaml \\\n  ghcr.io/h3nr1-d14z/nat-gate apply -c /etc/nat-gate/rules.yaml\n```\n\n## How It Works\n\nnat-gate manages iptables NAT rules to forward incoming traffic to Tailscale IPs:\n\n1. **PREROUTING (DNAT)**: Rewrites the destination IP of incoming packets\n2. **POSTROUTING (MASQUERADE)**: Ensures return traffic is properly routed\n\nAll rules are tagged with a comment (`nat-gate:\u003cproto\u003e:\u003cport\u003e`) for safe identification and removal.\n\n## Example Use Case\n\nYou have a web server running on a machine with Tailscale IP `100.64.0.5`, but it's behind NAT and can't receive incoming connections. You have a VPS with a public IP.\n\nOn your VPS:\n\n```bash\n# One-time setup\nsudo nat-gate init\n\n# Forward HTTPS traffic to your web server\nsudo nat-gate add tcp 443 100.64.0.5\n\n# Forward HTTP traffic too\nsudo nat-gate add tcp 80 100.64.0.5\n\n# Forward a range of ports for dev server\nsudo nat-gate add tcp 3000-3010 100.64.0.5\n\n# Optional: Install as a service for persistence\nsudo nat-gate service install\n```\n\nNow traffic to your VPS on ports 80, 443, and 3000-3010 is forwarded through Tailscale to your web server.\n\n## Requirements\n\n- Linux (iptables)\n- Root/sudo access\n- Tailscale installed and connected\n- `iptables-persistent` recommended for rule persistence\n\n## Safety Features\n\n- All rules are tagged with identifiable comments\n- Only removes rules created by nat-gate\n- Validates all inputs (protocol, port range, IP format)\n- Checks for root privileges before any operation\n- Warns if rules can't be persisted\n- Dry-run mode to preview changes\n- Rate limiting to protect services\n\n## Documentation\n\n- [Troubleshooting Guide](docs/TROUBLESHOOTING.md) - Common issues and solutions\n- [Man Page](docs/nat-gate.1) - Full command reference\n\n## Building from Source\n\n```bash\ngit clone https://github.com/h3nr1-d14z/nat-gate\ncd nat-gate\ncargo build --release\n```\n\nBinary will be at `target/release/nat-gate`.\n\n### Cross-compilation\n\n```bash\n# Install cross\ncargo install cross\n\n# Build for Linux x86_64\ncross build --target x86_64-unknown-linux-musl --release\n\n# Build for Linux ARM64\ncross build --target aarch64-unknown-linux-musl --release\n```\n\n### Docker Build\n\n```bash\ndocker build -t nat-gate .\n```\n\n## License\n\nMIT License - see [LICENSE](LICENSE) for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fh3nr1-d14z%2Fnat-gate","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fh3nr1-d14z%2Fnat-gate","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fh3nr1-d14z%2Fnat-gate/lists"}