Nftables how to fix ping error?

Question

iptables

After adding nat and forward rules, ping stops working on the server, gives an error "ping: sendmsg: Operation not allowed". Server on CentOS Linux release 8.1.1911 (Core), kernel 4.18.0-147.5.1.el8_1.x86_64, version nftables v0.9.0.

The rules themselves:

table inet filter {
        chain input {
                type filter hook input priority 0; policy drop;
                ct state established,related accept
                iif "lo" accept
                ct state invalid drop
                ip protocol icmp accept
                ip protocol igmp accept
                tcp dport ssh accept comment "SSH"
                udp dport { netbios-ns, netbios-dgm } accept comment "Samba udp ports"
                tcp dport { netbios-ssn, microsoft-ds } accept comment "Samba tcp ports"
                tcp dport { 35621, 35623, 55413-55415 } accept comment "UrBackup tcp ports"
                udp dport { 35621, 35622, 35623 } accept comment "UrBackup udp ports"
                tcp dport 9090 accept comment "Cockpit Web Interface"
                udp dport tftp accept comment "tftp"
                tcp dport { ftp-data, ftp } accept comment "ftp"
        }
}
table ip nat {
        chain post {
                type nat hook postrouting priority 100; policy drop;
                ip saddr 192.168.1.2 oif "enp2s0.103" snat to 10.14.1.58
                ip saddr 192.168.1.4 oif "enp2s0.103" snat to 10.14.1.58
                ip saddr 192.168.1.6 oif "enp2s0.103" snat to 10.14.1.58
                ip saddr 192.168.1.7 oif "enp2s0.103" snat to 10.14.1.58
        }

        chain forward {
                type filter hook forward priority 0; policy drop;
                ct state established,related accept
                ip saddr 192.168.1.2 oif "enp2s0.103" accept
                ip saddr 192.168.1.4 oif "enp2s0.103" accept
                ip saddr 192.168.1.6 oif "enp2s0.103" accept
                ip saddr 192.168.1.7 oif "enp2s0.103" accept
        }
}

At the same time, nat works for the specified users, ping works properly for them, it does not work only on the server. Please point out where I made a mistake in the rules.

Answer 1

Change the policy to accept on ip nat post, do not drop packets during nating. And check the policy on the output, it should be accept, otherwise "you yourself have limited the sending of something outside and you are complaining."