Iptables + traceroute + NAT = invalid packet? :-(

Iptables + traceroute + NAT = invalid packet? :-(

[Dmitry Ananjev]

Hello!

I have a problem with the connection tracking state extension.
I want to allow traceroute from my local network, so I configured my 
firewall to accept outgoing packets from my network.
I also accept established, related pachets and log&drop invalid packets:

iptables -A INPUT -m state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state INVALID -j LOG
iptables -A INPUT -m state INVALID -j DROP
iptables -A INPUT -i <LAN_IFACE> -j ACCEPT

iptables -A OUTPUT -m state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state INVALID -j LOG
iptables -A OUTPUT -m state INVALID -j DROP

iptables -A FORWARD -m state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state INVALID -j LOG
iptables -A FORWARD -m state INVALID -j DROP
iptables -A RORWARD -i <LAN_IFACE> -j ACCEPT

iptables -A POSTROUTING -o <INET_IFACE> -j SNAT --to-source <INET_IP>

However, at this time a traceroute from my local network to an external 
host looks like that:

---
Tracing route to ya.ru [213.180.193.123]
over a maximum of 30 hops:

  1     *        *        *     Request timed out.
  2    22 ms    23 ms    31 ms  213.156.200.xxx
  3    31 ms    21 ms    23 ms  213.156.195.xxx
  4    25 ms    50 ms    25 ms  e12.bcn1.xxx.xxx [213.156.192.xxx]
etc.
---

cat /var/log/messages
-------------
Jan 12 14:30:02 serv kernel: INVALID output: IN= OUT=eth0 
SRC=192.168.2.1 DST=192.168.2.10 LEN=120 TOS=0x00 PREC=0xC0 TTL=64 
ID=54714 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.2.10 DST=213.180.193.123 
LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=26615 PROTO=ICMP TYPE=8 CODE=0 ID=512 
SEQ=32768 ]
-------------

So why does the time-exceeded answer have the state 
INVALID, though it should be RELATED as far as i can see it?
Am I doing something wrong or is it even an iptables bug?

Thank you!
WBR, Dmitry Ananjev
altex@crazy.ru