Re: snat and ICMP question

[Marian Stagarescu <marian@ti.com>]

for a quick test you can try to masquerade all and see if the error persists:

iptables -t nat -A POSTROUTING -o outgoing-interface -j MASQUERADE.

can you post the icmp error message ?

an ICMP does have an outter ip hdr and an inner ip dhr
the inner ip hdr is the ip hdr of the dgram that caused the error, 
hence should be the web server ip.
the outer ip hdr should be NATed address if you do the above masquerading.

marian



On Wednesday 09 October 2002 07:16 am, Ciaran Deignan wrote:
> > > > iptables -t mangle -A PREROUTING --in-interface ipsec+ \
> > > >                         -j MARK --set-mark 1
> > > > iptables -t nat -A POSTROUTING -m mark --mark 1 \
> > > >                                 -j MASQUERADE
> >
> > config. Actually, the web server is on the private interface.
> >
> > The ICMP error message contains the real address of the
> > remote user. Do you think I should mark ICMP messages
> > on the OUTPUT chain? I must try that...
>
> I tried adding the following rule, but that didn't change
> anything:
>
> 	iptables -t mangle -A OUTPUT -p ICMP -j MARK --set-mark 1
>
> Is there any way I could cause the ICMP error to be
> generated before the packet is de-nated?
>
> Ciaran