diff --git a/docs/vpp/configuration/nat/nat44.rst b/docs/vpp/configuration/nat/nat44.rst index 006edb86e5..0201ec3af0 100644 --- a/docs/vpp/configuration/nat/nat44.rst +++ b/docs/vpp/configuration/nat/nat44.rst @@ -554,24 +554,6 @@ This setting helps prevent memory exhaustion and ensures predictable performance # Increase session limit for high-capacity deployment set vpp settings nat44 session-limit 100000 -Forwarding Behavior -------------------- - -By default, VyOS NAT44 forwards packets that don't match any NAT rules according to the routing table. This behavior can be controlled: - -.. cfgcmd:: set vpp settings nat44 no-forwarding - - Disable forwarding of packets that don't match existing NAT translations. When enabled, only packets that match static or dynamic NAT rules will be processed; all other traffic will be dropped. - -.. important:: - - This is a significant difference from traditional NAT solutions. By default, VyOS NAT44 allows non-NAT traffic to be forwarded normally. Using ``no-forwarding`` creates a pure NAT-only device that drops any traffic not covered by NAT rules. - -**Use cases for no-forwarding:** - -* **Pure NAT gateway**: When the router should only handle NAT traffic and drop everything else -* **Security isolation**: Preventing any non-NAT traffic from traversing the device - Worker Assignment -----------------