view nat mappings

view nat mappings

[Stephen Clark]

Hello List,

Does iptables have the capability to list out the actual nat 
mappings/translations,
not just the rules that are currently active -
similar to the way FreeBSD's ipfilter/ipnat does?

I've perused the man pages and googled but was unable to find anything 
that seemed
pertinent.

TIA,
Steve

Re: view nat mappings

[Krzysztof Oledzki]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 373 bytes --]



On Thu, 2 Feb 2006, Stephen Clark wrote:

> Hello List,
Hello,

> Does iptables have the capability to list out the actual nat 
> mappings/translations,
> not just the rules that are currently active -
Please use "conntrack -L" or "cat /proc/net/ip_conntrack" for older 
kernels than 2.6.14.

Best regards,

 			Krzysztof Olędzki

PS: This is a devel ml.

Re: view nat mappings

[Pablo Neira Ayuso]

Stephen Clark wrote:
> Does iptables have the capability to list out the actual nat
> mappings/translations,
> not just the rules that are currently active -
> similar to the way FreeBSD's ipfilter/ipnat does?

So, if I understood well, you want to get only current nat'ted
connections, right?

If so, this is fairly easy to implement in the conntrack tool. Something
like `conntrack -L nat` to show all current nat'ed connections. Is this
really of interest for everyone?

-- 
Pablo

Re: view nat mappings

[Stephen Clark]

Pablo Neira Ayuso wrote:

>Stephen Clark wrote:
>  
>
>>Does iptables have the capability to list out the actual nat
>>mappings/translations,
>>not just the rules that are currently active -
>>similar to the way FreeBSD's ipfilter/ipnat does?
>>    
>>
>
>So, if I understood well, you want to get only current nat'ted
>connections, right?
>
>If so, this is fairly easy to implement in the conntrack tool. Something
>like `conntrack -L nat` to show all current nat'ed connections. Is this
>really of interest for everyone?
>
>  
>
Actually this is on an embedded system running uClinux 2.4.6, an 
ActionTec DualPC Modem.
I am trying to use it as backup for ipsec traffic. Everything works 
great until we have an interruption - like the phone connection drops 
the vpn won't get reestablished. But when we
use an Apple Airport Extreme Base Station - the vpn get reestablished 
with no problem. So it
seems ther is some state in the ActionTec modem/router - it is 
performing masquerading - that keep the vpn from coming up. IT is really 
strange because we get SA's (isakmp traffic) on both sides, but esp 
traffic never gets across.

Steve
traffic doesn't