Re: view nat mappings

[Stephen Clark <stephen.clark@earthlink.net>]

Pablo Neira Ayuso wrote:

>Stephen Clark wrote:
>  
>
>>Does iptables have the capability to list out the actual nat
>>mappings/translations,
>>not just the rules that are currently active -
>>similar to the way FreeBSD's ipfilter/ipnat does?
>>    
>>
>
>So, if I understood well, you want to get only current nat'ted
>connections, right?
>
>If so, this is fairly easy to implement in the conntrack tool. Something
>like `conntrack -L nat` to show all current nat'ed connections. Is this
>really of interest for everyone?
>
>  
>
Actually this is on an embedded system running uClinux 2.4.6, an 
ActionTec DualPC Modem.
I am trying to use it as backup for ipsec traffic. Everything works 
great until we have an interruption - like the phone connection drops 
the vpn won't get reestablished. But when we
use an Apple Airport Extreme Base Station - the vpn get reestablished 
with no problem. So it
seems ther is some state in the ActionTec modem/router - it is 
performing masquerading - that keep the vpn from coming up. IT is really 
strange because we get SA's (isakmp traffic) on both sides, but esp 
traffic never gets across.

Steve
traffic doesn't