From 18f24898fbac2bcc04bac9315baf782d8f2f3c39 Mon Sep 17 00:00:00 2001
From: ITQ <itq.dev@ya.ru>
Date: Sat, 25 Jul 2026 18:55:19 +0300
Subject: [PATCH] feat(roles/security): added destination filter to DNAT

---
 roles/security/templates/nftables.conf.j2 | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/roles/security/templates/nftables.conf.j2 b/roles/security/templates/nftables.conf.j2
index ec301e1..edc9d58 100644
--- a/roles/security/templates/nftables.conf.j2
+++ b/roles/security/templates/nftables.conf.j2
@@ -248,6 +248,9 @@ table ip ansible_nat {
 {% if rule.source is defined %}
 {% set _ = dnat_match.append('ip saddr ' + rule.source) %}
 {% endif %}
+{% if rule.destination is defined %}
+{% set _ = dnat_match.append('ip daddr ' + rule.destination) %}
+{% endif %}
 {% set _ = dnat_match.append(proto + ' dport ' + rule.port | string) %}
 {% if rule.redirect is defined %}
         {{ dnat_match | join(' ') }} redirect to :{{ rule.redirect }}{{ comment }}