[IPTABLES] Symmetric NAT?

[IPTABLES] Symmetric NAT?

[Olivier GRALL]

Hi,

I was making some tests with STUN when I realize that my NAT box was a 
simple Linux Box with an IPTABLES rule with a MASQ target. What seemed 
strange to me was that the STUN result was "Port restricted cone ".

I made a new with NATcheck.exe... same result.
http://midcom-p2p.sourceforge.net/

I was sure IPTABLES NAT was Symmetric and not Port restricted cone. What 
about it ?
In the "Procceding of NetFilter Developer WorkShop 2004",  Harald Welte 
reported "

netfilter however implements (SNAT and MASQ) as ssymmetric.
"


For me, with MASQ it is Port restricted cone and with SNAT+DNAT it is 
Symmetric. Is it true ?

Thanx,

-- 

	
Olivier GRALL
R&D Engineer 	*NeoTIP** S.A.*
4, rue Louis de Broglie
22300 Lannion
France
olivier.grall@neotip.com <mailto:olivier.grall@neotip.com> 	+33 (0)2 96 
48 66 94

Re: [IPTABLES] Symmetric NAT?

[Harald Welte]

On Fri, Oct 14, 2005 at 02:10:46PM +0200, Olivier GRALL wrote:
> Hi,
> 
> I was making some tests with STUN when I realize that my NAT box was a simple Linux Box with an IPTABLES 
> rule with a MASQ target. What seemed strange to me was that the STUN result was "Port restricted cone ".
> 
> I made a new with NATcheck.exe... same result.
> http://midcom-p2p.sourceforge.net/
> 
> I was sure IPTABLES NAT was Symmetric and not Port restricted cone. What about it ?
> In the "Procceding of NetFilter Developer WorkShop 2004",  Harald Welte reported "
> 
> netfilter however implements (SNAT and MASQ) as ssymmetric.
> "

iptable_nat implements a fully symmetric port-overloading NAT.

-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[IPTABLES] Symmetric NAT ?

[Olivier GRALL]

Hi,

I was making some tests with STUN when I realize that my NAT box was a 
simple Linux Box with an IPTABLES rule with a MASQ target. What seemed 
strange to me was that the STUN result was "Port restricted cone ".

I made a new with NATcheck.exe... same result.
http://midcom-p2p.sourceforge.net/

I was sure IPTABLES NAT was Symmetric and not Port restricted cone. What 
about it ?
In the "Procceding of NetFilter Developer WorkShop 2004",  Harald Welte 
reported "

netfilter however implements (SNAT and MASQ) as ssymmetric.
"


For me, with MASQ it is Port restricted cone and with SNAT+DNAT it is 
Symmetric. Is it true ?

Thanx,
-- 

	
Olivier GRALL
R&D Engineer 	*NeoTIP** S.A.*
4, rue Louis de Broglie
22300 Lannion
France
olivier.grall@neotip.com <mailto:olivier.grall@neotip.com> 	+33 (0)2 96 
48 66 94