Re: IPv4 NAT and lo, and iptables

[<imnozi@gmail.com>]

Thank you! It *is* an oddity; but it's the nature of the beast. Added two rules and it works.

Cheers 'n' beers!
Neal


On Wed, 1 May 2024 01:03:28 +0200 (CEST)
Sven-Haegar Koch <haegar@sdinet.de> wrote:

> On Tue, 30 Apr 2024, imnozi@gmail.com wrote:
> 
> > Questions:
> >   - Is lo ignored in PREROUTING?
> >   - Is it possible to DNAT local traffic on FW_A (changing) the public IP to
> >     the private IP on LAN_2?
> >   - Would I specify '-i lo' in mangle:PREROUTING and nat:PREROUTING (as I do
> >     for the real NICs)?
> > 
> > The uber questions are:
> >   - Should I be able to DNAT and SNAT traffic on lo just as I can on other
> >     LANs, or do I need to take extra steps?  
> 
> Locally generated traffic does not pass nat PREROUTING chain - you need 
> to add matching DNAT rules to the nat OUTPUT chain if you want dnat 
> rewriting applied to it.
> 
> And similar traffic targetting the local system (after DNAT) does not 
> pass POSTROUTING, if you want such traffic SNAT'ed you need to use the 
> nat INPUT chain.
> 
> >   - Is this a known oddity? or was it known back around Linux 3.16 and
> >     iptables 1.6? (Don't ask; sometimes we're stuck in a place we don't
> >     want to be.)  
> 
> c'ya
> sven-haegar
>