SNAT in OUTPUT chain of the nat table question?

SNAT in OUTPUT chain of the nat table question?

[bauer]

Is there a good reason that I am unable to conceive of at the 
moment why SNAT is not a valid target in the OUTPUT chain of the
nat table? 

Thanks,
Steve 

Re: SNAT in OUTPUT chain of the nat table question?

[Ranjeet Shetye]

On Thu, 2003-01-09 at 01:37, bauer@mit.edu wrote:
> Is there a good reason that I am unable to conceive of at the 
> moment why SNAT is not a valid target in the OUTPUT chain of the
> nat table? 
> 
> Thanks,
> Steve 
> 
> 

The OUTPUT chain is only for outgoing packets from the linux box itself.

The POSTROUTING chain is the one that contains all packets being
routed/forwarded.

-- 
Ranjeet Shetye
Senior Software Engineer
Zultys Technologies
Ranjeet dot Shetye2 at Zultys dot com
http://www.zultys.com/

Re: SNAT in OUTPUT chain of the nat table question?

[Athan]

[-- Attachment #1: Type: text/plain, Size: 771 bytes --]

On Wed, Jan 08, 2003 at 07:37:21PM -0500, bauer@mit.edu wrote:
> Is there a good reason that I am unable to conceive of at the 
> moment why SNAT is not a valid target in the OUTPUT chain of the
> nat table? 

  From 'man iptables':

   SNAT
       This  target  is  only  valid  in  the  nat  table, in the
       POSTROUTING chain.  It specifies that the  source  address

SNAT gets done just as packets go out, hence only in the POSTROUTING
chain as you only know where they're going by then.

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]

Re: SNAT in OUTPUT chain of the nat table question?

[Joel Newkirk]

On Wednesday 08 January 2003 07:37 pm, bauer@mit.edu wrote:
> Is there a good reason that I am unable to conceive of at the
> moment why SNAT is not a valid target in the OUTPUT chain of the
> nat table?

Turn this around somewhat.  Can you present a case where SNAT would need 
to be done in the nat OUTPUT chain, that could not also be performed in 
the nat POSTROUTING chain achieving the same effect?  Even if you're 
going to localhost, packets don't go from OUTPUT straight to INPUT.

That said, connections originating on the local box addressed to any IP 
of the box itself do NOT appear in the nat-PREROUTING chain. (If you try 
to DNAT in PREROUTING it still comes back in INPUT instead of 
forwarding) Obviously this is a case where DNAT would be required in nat 
OUTPUT, where it is in fact a valid target.  This is the only way to 
DNAT a connection from the box to itself and send it elsewhere.

> Thanks,
> Steve

j

(stealing someone else's apropos sig, I believe Antony Stone's :^)
--
Perfection in design is achieved not when there is nothing left to add, 
but rather when there is nothing left to take away.

 - Antoine de Saint-Exupery