[MASQUERADING] iptables keeps sending from old IP after ppp0's IP has changed

[MASQUERADING] iptables keeps sending from old IP after ppp0's IP has changed

[Daniel Musketa]

Hello list,

I'm using iptables v1.2.11 on Debian Sarge kernel 2.6.8-3-k7.

This router does masquerading for my NAT clients. One of them is an Asterisk 
server communicating over UDP port 5060 (SIP) with external SIP provider. 

Every night the router's ppp0 goes down and after about a minute up again with 
a new IP. But iptables keeps on sending the NATted UDP packets _from_ the old 
IP address. `iptables -F` and reloading the rules doesn't help. The only 
workaround is to stop asterisk on the NAT client for about 2 minutes. 

I found out that there are still entrys in /proc/net/ip_conntrack containing 
yestrerday's external IP address.

Why isn't this table deleted when ppp0 goes down?

How can I force iptables to use ppp0's real IP address as sender IP in 
outgoing packets?


Thanks
Daniel

Re: [MASQUERADING] iptables keeps sending from old IP after ppp0's IP has changed

[Jan Engelhardt]

>
>Every night the router's ppp0 goes down and after about a minute up again with 
>a new IP. But iptables keeps on sending the NATted UDP packets _from_ the old 
>IP address. `iptables -F` and reloading the rules doesn't help. The only 
>workaround is to stop asterisk on the NAT client for about 2 minutes. 

That is how it is. The -t nat table is only consulted for NEW connections.

>Why isn't this table deleted when ppp0 goes down?

netfilter does not know it has gone down, I think.

>How can I force iptables to use ppp0's real IP address as sender IP in 
>outgoing packets?

Flush the conntrack table when ppp0 has gone up (yes, up)


Jan Engelhardt
-- 

Re: [MASQUERADING] iptables keeps sending from old IP after ppp0's IP has changed

[Pascal Hambourg]

Hello,

Jan Engelhardt a écrit :
>>Every night the router's ppp0 goes down and after about a minute up again with 
>>a new IP. But iptables keeps on sending the NATted UDP packets _from_ the old 
>>IP address. `iptables -F` and reloading the rules doesn't help. The only 
>>workaround is to stop asterisk on the NAT client for about 2 minutes. 
> 
> That is how it is. The -t nat table is only consulted for NEW connections.
> 
>>Why isn't this table deleted when ppp0 goes down?
> 
> netfilter does not know it has gone down, I think.

Unlike SNAT, isn't the MASQUERADE target supposed to delete obsolete 
masqueraded conntrack entries when the related interface goes down - or 
maybe when it goes up again with a different address ?

>>How can I force iptables to use ppp0's real IP address as sender IP in 
>>outgoing packets?
> 
> Flush the conntrack table when ppp0 has gone up (yes, up)

Why not when ppp0 has gone down ?

Re: [MASQUERADING] iptables keeps sending from old IP after ppp0's IP has changed

[Jan Engelhardt]

>
> Unlike SNAT, isn't the MASQUERADE target supposed to delete obsolete
> masqueraded conntrack entries when the related interface goes down - or maybe
> when it goes up again with a different address ?

You are right..

        if (event == NETDEV_DOWN) {                                             
                /* Device was downed.  Search entire table for                  
                   conntracks which were associated with that device,           
                   and forget them. */                                          
                IP_NF_ASSERT(dev->ifindex != 0);                                
                                                                                
                ip_ct_iterate_cleanup(device_cmp, (void *)(long)dev->ifindex);  
        }                                                                       


>> > How can I force iptables to use ppp0's real IP address as sender IP in
>> > outgoing packets?
>> 
>> Flush the conntrack table when ppp0 has gone up (yes, up)
>
> Why not when ppp0 has gone down ?

Er, whenever the status changes (both up and down).


Jan Engelhardt
-- 

Re: [MASQUERADING] iptables keeps sending from old IP after ppp0's IP has changed

[Daniel Musketa]

Am Mittwoch, 30. August 2006 15:01 schrieb Jan Engelhardt:
> >Every night the router's ppp0 goes down and after about a minute up again
> > with a new IP. But iptables keeps on sending the NATted UDP packets
> > _from_ the old IP address. `iptables -F` and reloading the rules doesn't
> > help. The only workaround is to stop asterisk on the NAT client for about
> > 2 minutes.
[...]
> >How can I force iptables to use ppp0's real IP address as sender IP in
> >outgoing packets?
>
> Flush the conntrack table when ppp0 has gone up (yes, up)

Is there a cleaner way than

#!/bin/sh
TIMEOUT=$(cat /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout)
TIMEOUT_STREAM=$(cat /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream)
	
echo 0 > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout
echo 0 > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream

sleep 10

echo ${TIMEOUT} > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout
echo ${TIMEOUT_STREAM} 
> /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream

#EOF

?

Daniel