iptables NAT with "policy routing?"

iptables NAT with "policy routing?"

[Brian Capouch]

I have had to temporarily use a table-based route for one of my networks 
for administrative reasons, e.g.

 > ip rule from 192.168.1.0/24 lookup table temp

Then

 > ip route add default via 192.168.127.1 dev eth0 table temp

I have standard iptables NAT rules for a host on that network:

iptables -t nat -A POSTROUTING -s 192.168.1.10 -j SNAT --to-source A.B.C.D

iptables -t nat -A PREROUTING -d A.B.C.D -j DNAT --to-destination 
192.168.1.10

**********

I suspect though, that this mode of routing (as opposed to using the 
"regular" table via "route add default") is somehow hosing my iptables NAT?

At least sniffing the egress interface now shows the traffic heading out 
with its NATted address of 192.168.1.10.

Newbie here, I guess.  Can someone help/enlighten?

Thx.

B.

Re: iptables NAT with "policy routing?"

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 1121 bytes --]

On Thu, Jan 22, 2004 at 01:49:08AM -0500, Brian Capouch wrote:
> I have had to temporarily use a table-based route for one of my networks 
> for administrative reasons, e.g.

this should work just fine.

> I suspect though, that this mode of routing (as opposed to using the 
> "regular" table via "route add default") is somehow hosing my iptables NAT?
> 
> At least sniffing the egress interface now shows the traffic heading out 
> with its NATted address of 192.168.1.10.

did you try that with a connection that was established before you
inserted the new NAT rule (also, if you test with a ping, you need to
stop it to be recognized as new connection).

LARTC mailinglist might give you some better feedback.

> Thx.
> B.

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]