RE: Does Redirect/NAT change the destination port of reverse tuple ?

["Nishit Shah" <nishit@elitecore.com>]

-----Original Message-----
From: netfilter-devel-owner@vger.kernel.org
[mailto:netfilter-devel-owner@vger.kernel.org] On Behalf Of Jan Engelhardt
Sent: Friday, February 29, 2008 4:59 PM
To: Nishit Shah
Cc: netfilter-devel@vger.kernel.org
Subject: Re: Does Redirect/NAT change the destination port of reverse tuple
?


On Feb 29 2008 16:19, Nishit Shah wrote:
>
>Hi,
>	I have following iptable rule in system.
>
>	iptables -I PREROUTING -t nat -p tcp --dport 443 -j REDIRECT
>--to-ports 3128
>	kernel - 2.6.16.13
>
>	I am using following scenario for load testing
>
>	192.168.206.200 -----> 192.168.121.125 	-----> 	72.14.223.83
>	Client			iptables/proxy server		server
>
>	and I am getting following entry through conntrack binay as well as
>in /proc/net/ip_conntrack
>
>	[NEW] tcp 6 120 NONE src=192.168.206.200 dst=72.14.223.83
>sport=63423 dport=443 packets=1 bytes=48 [UNREPLIED] src=192.168.121.125
>dst=192.168.206.200 sport=3128 dport=46873 packets=0 bytes=0 id=28187887
>
>Now here original and reverse tuples are --> 
>	Original tuple 192.168.206.200:63423->72.14.223.83:443
>	Reply tuple    192.168.121.125:3128->192.168.206.200:46873
>
>So, here destination port of reverse tuple is 46873. Is it correct ?

You could compare with the output of tcpdump to capture the
actual on-wire situation especially regarding port 46873.

In tcpdump output I am seeing packets only with port 63423. No packets with
port 46873. Something like

 192.168.206.200:63423->72.14.223.83:443 Syn
 72.14.223.83:443->192.168.206.200:63423 Syn Ack
 192.168.206.200:63423->72.14.223.83:443 Ack

Also, this happens with heavy load only. In normal conditions destination
port of reverse tuple doesn't change.

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel"
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html