I built a router with domain-scoped NAT policies — finer-grained than traditional NAT configuration

https://preview.redd.it/4hsqvxrtwqhh1.png?width=1920&format=png&auto=webp&s=2aed08caf2d8e0472201a1a37141e19517fea7ce

https://preview.redd.it/swgjfb0yvqhh1.png?width=1880&format=png&auto=webp&s=93c62f9b196aba0cf8aadaa886c2ac521adf7fc6

Most consumer routers make NAT behavior a global setting. Whether the router uses endpoint-independent or endpoint-dependent NAT behavior, the policy is usually global — every device gets the same NAT behavior. I wanted something more granular. Landscape adds a finer-grained NAT policy layer. Instead of choosing one NAT behavior for the entire network, NAT state creation and reuse can be controlled by traffic policies. The default policy is destination-locked: A NAT state created for one destination cannot be reused by another destination unless an explicit policy allows it. Basically: least-privilege NAT policies. A Flow is one way to define these policies in Landscape. It defines: - which clients match (IP/MAC based) - where traffic exits (WAN interface or container) - which domain/IP rules apply - how NAT state is created Example — using checkmynat.com only to demonstrate the mechanism: | Policy | Device | Destination | NAT policy | |---------|----------|-------------------|---------------------| | default | Device A | checkmynat.com | Full Cone | | default | Device A | everything else | Destination-locked | | iot | Device B | everything | Destination-locked | Same device. Different destination. Different NAT behavior. Some applications genuinely need Full Cone behavior: - P2P games - mesh VPNs - some VoIP applications But enabling it globally means every device gets that behavior. Landscape lets you create narrow exceptions instead. Landscape is a Linux soft router written in Rust. Packet decisions happen directly in the kernel using eBPF (TC/XDP). ``` DNS resolution ↓ domain/IP policy (per Flow) ↓ eBPF maps ↓ kernel packet processing ``` No userspace packet forwarding loop. Current limitations: - wired gateway only (no WiFi yet) - apps bypassing system DNS need IP rules instead - requires Linux kernel 6.9+ with BTF Source: https://github.com/ThisSeanZhang/landscape Docs: https://landscape.whileaway.dev/ Would love feedback, especially from people who have dealt with NAT traversal issues.