Re: is this make sense: iptables -A PREROUTING -t nat -j SNAT --to 0.0.0.0

[Nguyen Dinh Nam <64vn@cardvn.net>]

I use each -j SNAT for an interface because -j MASQUERADE doesn't work 
well with multipath routes, and SNAT has better performance than MASQ.

CONNMARK helps keeping packets of the same connection routed via a given 
nexthop which is selected by the multipath route for the first (--state 
NEW) packet, I wrote about it here:
http://selab.edu.ms/twiki/bin/view/Networking/MultihomedLinuxNetworking
it's a vital part of a multihomed internet gateway. With SNAT/MASQ 
available in PREROUTING, CONNMARK is no long required, hence save a lot 
of works and increase the performance.

Max Kellermann wrote:

> Why don't you just use -j MASQUERADE if writing one rule per interface
> is too much work for you?
>
> I don't understand how CONNMARK helps with your "traditional method".
>
> Max
>