Re: SNAT in OUTPUT chain of the nat table question?

[Joel Newkirk <netfilter@newkirk.us>]

On Wednesday 08 January 2003 07:37 pm, bauer@mit.edu wrote:
> Is there a good reason that I am unable to conceive of at the
> moment why SNAT is not a valid target in the OUTPUT chain of the
> nat table?

Turn this around somewhat.  Can you present a case where SNAT would need 
to be done in the nat OUTPUT chain, that could not also be performed in 
the nat POSTROUTING chain achieving the same effect?  Even if you're 
going to localhost, packets don't go from OUTPUT straight to INPUT.

That said, connections originating on the local box addressed to any IP 
of the box itself do NOT appear in the nat-PREROUTING chain. (If you try 
to DNAT in PREROUTING it still comes back in INPUT instead of 
forwarding) Obviously this is a case where DNAT would be required in nat 
OUTPUT, where it is in fact a valid target.  This is the only way to 
DNAT a connection from the box to itself and send it elsewhere.

> Thanks,
> Steve

j

(stealing someone else's apropos sig, I believe Antony Stone's :^)
--
Perfection in design is achieved not when there is nothing left to add, 
but rather when there is nothing left to take away.

 - Antoine de Saint-Exupery