Re: NAT and DNS/NTP servers

["Andrew E. Mileski" <andrewm@isoar.ca>]

Antony Stone wrote:
> On Saturday 01 May 2004 3:52 am, Andrew E. Mileski wrote:
> 
>>I'm observing lost packets when a gateway doing NAT also locally hosts
>>a server for DNS or NTP.  I believe this the result of the ambiguous
>>conditions that can exist when routing server-to-server packets coming
>>into the gateway.
> 
> Show us your rules and explain what is ambiguous about them?

There is only one rule needed if all other defaults are ACCEPT:

This one is on my network:
iptables -t nat -A POSTROUTING -s ! $WAN_IP -o $WAN_IFC -j SNAT 
--to-source $WAN_IP

This one is on another network with the same problem:
iptables -t nat -A POSTROUTING -s $INTERNAL_NET -j MASQUERADE

Both DNS and NTP server-to-server UDP packets have the same source
and destination ports.  What I am seeing is a failure to remap the
source port on outgoing packets when a local server is running on
the gateway.

I speculate this is because an idle local server without an active
connection doesn't have an entry in the connection table.  Though
I've also seen failures with an active local server, but I haven't
got a good theory on the mechanics behind it yet.

I have seen port remapping in some situations, so I know that
feature works.  It just isn't being triggered in some situations,
which I can't yet reason why.

As an aside, I think (S?)NTP pays attention to the source port, so
a port remap may have side effects for this protocol.  This isn't
a concern of mine though.

-- 
Andrew E. Mileski