local connections getting natted

local connections getting natted

[clister]

Hello, 
i have a this setup on nat table.

Chain PREROUTING (policy ACCEPT 1456K packets, 384M bytes)
 pkts bytes target     prot opt in     out     source               
destination

Chain POSTROUTING (policy ACCEPT 20 packets, 1192 bytes)
 pkts bytes target     prot opt in     out     source               
destination
 185K 8942K SNAT       all  --  *      eth0    0.0.0.0/0            0.0.0.0/0          
to:1.2.3.4

Chain OUTPUT (policy ACCEPT 74 packets, 4622 bytes)
 pkts bytes target     prot opt in     out     source               
destination

Connections coming from eth1 (internal network 10.10.10.x) to eth0 (external) 
get natted to to 1.2.3.4 , it's correct for me but whenever i try to connect 
from this box to inet i get natted also to 1.2.3.4. 

I thought this happened only if you create such rule on NAT::ouput so local 
connections get natted prior to go out of the box.

Should i change this to:
-t nat -A POSTROUTING -i eth1 -o eth0 -j SNAT --to-destination:1.2.3.4 to 
avoid local packets getting natted?

and last question:
All packets leaving routing code (local, forwarded) pass througth POSTROUTING 
chain at nat table or only forwarded packets?

Thanks

Re: local connections getting natted

[Kiran Kumar]

--- clister <clister@uah.es> wrote:
> i have a this setup on nat table.
> 
> Chain POSTROUTING (policy ACCEPT 20 packets, 1192
> bytes)
>  pkts bytes target     prot opt in     out    
> source               
> destination
>  185K 8942K SNAT       all  --  *      eth0   
> 0.0.0.0/0            0.0.0.0/0          
> to:1.2.3.4

> Connections coming from eth1 (internal network
> 10.10.10.x) to eth0 (external) 
> get natted to to 1.2.3.4 , it's correct for me but
> whenever i try to connect 
> from this box to inet i get natted also to 1.2.3.4. 

  Yes, you have specified 0.0.0.0/0 which is
'anywhere'. Packets coming in from anywhere will be
satisfying this match. So local packets get natted as
well. I think you should change your iptable rule to
include -i eth1

> 
> I thought this happened only if you create such rule
> on NAT::ouput so local 
> connections get natted prior to go out of the box.

  Sorry, did not get what you mean by this.

> 
> Should i change this to:
> -t nat -A POSTROUTING -i eth1 -o eth0 -j SNAT
> --to-destination:1.2.3.4 to 
> avoid local packets getting natted?

Right.

> 
> and last question:
> All packets leaving routing code (local, forwarded)
> pass througth POSTROUTING 
> chain at nat table or only forwarded packets?

Not sure about this.

=====
Regards,
Kiran Kumar Immidi

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/

Re: local connections getting natted

[prabha]

Hi

>     185K 8942K SNAT       all  --  *      eth0    0.0.0.0/0
0.0.0.0/0
to:1.2.3.4

This rule will change the source address of all the packet going out of
the eth0 interface. (Irrespective of whether they are local packets or
forwarded packets)

>I thought this happened only if you create such rule on NAT::ouput so
local
>connections get natted prior to go out of the box.

The NAT:OUTPUT chain will do a NAT for local packets (ie) packets
generated by the local machine.

>Should i change this to:
>-t nat -A POSTROUTING -i eth1 -o eth0 -j SNAT --to-destination:1.2.3.4
to
>avoid local packets getting natted?

Yes, this should work.

>and last question:
>All packets leaving routing code (local, forwarded) pass througth
>POSTROUTING chain at nat table or only forwarded packets?

Yes, all the packets will pass through the POSTROUTING chain.

Prabha

Re: topic local connections getting natted

[clister]

Hi all

I've probed to include -i eth1 on POSTROUTING but it seems to not accept input interface specificaction on POSTROUTING 
chain so i cant separate local packets from forwarded packets by inspecting that.

im going to try marking local packets on FILTER::OUTPUT chain so they get ignored on postrouting chaing.

What Chain should i use for this NAT::OUTPUT or FILTER::OUTPUT so it's seen before NAT::POSTROUTING?

El Miércoles, 4 de Febrero de 2004 06:54, prabha escribió:
> Hi
>
> >     185K 8942K SNAT       all  --  *      eth0    0.0.0.0/0
>
> 0.0.0.0/0
> to:1.2.3.4
>
> This rule will change the source address of all the packet going out of
> the eth0 interface. (Irrespective of whether they are local packets or
> forwarded packets)
>
> >I thought this happened only if you create such rule on NAT::ouput so
>
> local
>
> >connections get natted prior to go out of the box.
>
> The NAT:OUTPUT chain will do a NAT for local packets (ie) packets
> generated by the local machine.
>
> >Should i change this to:
> >-t nat -A POSTROUTING -i eth1 -o eth0 -j SNAT --to-destination:1.2.3.4
>
> to
>
> >avoid local packets getting natted?
>
> Yes, this should work.
>
> >and last question:
> >All packets leaving routing code (local, forwarded) pass througth
> >POSTROUTING chain at nat table or only forwarded packets?
>
> Yes, all the packets will pass through the POSTROUTING chain.
>
> Prabha