From mboxrd@z Thu Jan 1 00:00:00 1970 From: KOVACS Krisztian Subject: Re: Symmetric NAT for udp Date: Thu, 17 Nov 2005 13:34:11 +0100 Message-ID: <200511171334.12015@nienna> References: <437C70F5.2090401@ipcb.net> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Cc: Dmitry Return-path: To: netfilter-devel@lists.netfilter.org In-Reply-To: <437C70F5.2090401@ipcb.net> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-devel-bounces@lists.netfilter.org Errors-To: netfilter-devel-bounces@lists.netfilter.org List-Id: netfilter-devel.vger.kernel.org Hi, On Thursday 17 November 2005 13.00, Dmitry wrote: > Hi all - i have a trouble with making netfilter nat act like symmetric > for udp . Normally for udp it acts like port restricted cone nat ( the > main feature is that it doesnt mangle src port if several udp packets > come from same src ip/port - to different dest. In case of tcp it acts > like symmetric nat - ie each syn packet even from same src ip/port cause > src port mangling. What i need is to make it act like symmetric for udp > too. So i just looked throught udp/tcp specific files > (conntrack_proto_udp, nat_proto_udp and relative tcp ) and didnt find > anything that makes it work different for tcp and udp. Tests revealed > that at first time (and after timeout) each udp packets (even from same > src port/ip but to diff dest ) cause new conntrack creation. But when > it checkes before postrouting is tuple taken - for same src/port > somehow it says that no - so mangling doesnt occur. Can somebody give me > a hint where to dig? Dmitry, you don't even mention the exact version number of the kernel you're testing. Could you tell us that precious information? By the way, it would help a _lot_ if you could write nfsim testcases demonstrating the problem (the difference between TCP and UDP) you're seeing. Would that be possible? -- Regards, Krisztian Kovacs