Table NAT and MANGLE

Table NAT and MANGLE

[Gervasio Bernal]

Hi all!!

Suppose I have this 2 rules, one in mangle and the other one in NAT table:

#iptables -t mangle -A POSTROUTING -o eth0 -j TTL --ttl-set 64
#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

So, every time a packet goes out through eth0 first it sets the TTL to
64 and then do the masquerade. Is there any way to do this but in
opposite order? First masquerade and the TTL.
Maybe this example is not very clear, but I'm developing a module that
needs to match a packet after masquerade.

Thanks.

Re: Table NAT and MANGLE

[Chinh Nguyen]

Gervasio Bernal wrote:
> Hi all!!
> 
> Suppose I have this 2 rules, one in mangle and the other one in NAT table:
> 
> #iptables -t mangle -A POSTROUTING -o eth0 -j TTL --ttl-set 64
> #iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
> 
> So, every time a packet goes out through eth0 first it sets the TTL to
> 64 and then do the masquerade. Is there any way to do this but in
> opposite order? First masquerade and the TTL.
> Maybe this example is not very clear, but I'm developing a module that
> needs to match a packet after masquerade.
> 
> Thanks.
> 

>From the manual for SNAT "... and rules should cease being examined". You can't
do anything after SNAT. Since MASQUERADE is kind of a special case of SNAT, IMO,
you can't use another rule after MASQUERADE either.

It should be noted that there seems to be at least 1 exception, although I don't
know if there are others.

For example, with the latest iptables & kernel (2.6.16-rc4 as of this writing),
you can SNAT (probably MASQUERADE) or DNAT before encrypting a packet with
IPsec. This is accomplished by using the -m policy module.

iptables -A POSTROUTING -t nat -m policy ... -j SNAT.

In other words, any packet that matches an IPSec policy can then be SNAT/DNAT
before encryption/decryption. Practically, there is an action (encryption) that
is applied after the NAT. Functionally though, it's still only 1 SNAT/DNAT rule
 after which no other will apply.

But perhaps there are other "2 rules in 1" exceptions. I don't know myself.

Regards.