From: Ciaran Deignan <ciaran.deignan@netcelo.com>
To: Marian Stagarescu <marian@ti.com>,
netfilter-devel@lists.netfilter.org,
Matthieu Marc <matthieu.marc@netcelo.com>
Subject: Re: snat and ICMP question
Date: Wed, 09 Oct 2002 13:16:27 +0200 [thread overview]
Message-ID: <3DA4100B.79866BC0@netcelo.com> (raw)
In-Reply-To: 3DA400B9.390A17F7@netcelo.com
> > > iptables -t mangle -A PREROUTING --in-interface ipsec+ \
> > > -j MARK --set-mark 1
> > > iptables -t nat -A POSTROUTING -m mark --mark 1 \
> > > -j MASQUERADE
> >
> config. Actually, the web server is on the private interface.
>
> The ICMP error message contains the real address of the
> remote user. Do you think I should mark ICMP messages
> on the OUTPUT chain? I must try that...
I tried adding the following rule, but that didn't change
anything:
iptables -t mangle -A OUTPUT -p ICMP -j MARK --set-mark 1
Is there any way I could cause the ICMP error to be
generated before the packet is de-nated?
Ciaran
--
+---------------------------------------------------------+
Ciaran Deignan 04 38 49 87 27
Netcelo SA - IPsec VPN Solutions http://www.netcelo.com/
18-20 rue Henri Barbusse - BP 2501, 38035 Grenoble Cedex 2
+---------------------------------------------------------+
next prev parent reply other threads:[~2002-10-09 11:16 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-10-08 16:52 snat and ICMP question Ciaran Deignan
2002-10-08 19:00 ` Marian Stagarescu
2002-10-09 10:11 ` Ciaran Deignan
2002-10-09 11:16 ` Ciaran Deignan [this message]
2002-10-09 13:34 ` Marian Stagarescu
2002-10-10 10:23 ` Ciaran Deignan
2002-10-10 10:41 ` Balazs Scheidler
-- strict thread matches above, loose matches on Subject: below --
2002-10-03 10:20 Ciaran Deignan
2002-10-03 12:36 ` Ciaran Deignan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3DA4100B.79866BC0@netcelo.com \
--to=ciaran.deignan@netcelo.com \
--cc=marian@ti.com \
--cc=matthieu.marc@netcelo.com \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.