Re: Symmetric NAT for udp

[KOVACS Krisztian <hidden@balabit.hu>]

  Hi,

On Thursday 17 November 2005 13.00, Dmitry wrote:
> Hi all - i have a trouble with making netfilter nat act like symmetric
> for udp . Normally for udp  it acts like port restricted cone nat ( the
> main feature is that it doesnt mangle src port if several udp packets
> come from same src ip/port - to different dest. In case of tcp it acts
> like symmetric nat - ie each syn packet even from same src ip/port cause
> src port  mangling. What i need is to make it act like symmetric for udp
> too. So i just looked throught udp/tcp specific files
> (conntrack_proto_udp, nat_proto_udp and relative tcp ) and didnt find
> anything that makes it work different for tcp and udp. Tests revealed
> that at first time (and after timeout) each udp packets  (even from same
> src port/ip but to diff dest ) cause  new conntrack creation. But when
> it checkes before postrouting is tuple taken  - for same src/port
> somehow it says that no - so mangling doesnt occur. Can somebody give me
> a hint where to dig?

  Dmitry, you don't even mention the exact version number of the kernel 
you're testing. Could you tell us that precious information?

  By the way, it would help a _lot_ if you could write nfsim testcases 
demonstrating the problem (the difference between TCP and UDP) you're 
seeing. Would that be possible?

-- 
 Regards,
  Krisztian Kovacs