Re: [MASQUERADING] iptables keeps sending from old IP after ppp0's IP has changed

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Jan Engelhardt a écrit :
>>Every night the router's ppp0 goes down and after about a minute up again with 
>>a new IP. But iptables keeps on sending the NATted UDP packets _from_ the old 
>>IP address. `iptables -F` and reloading the rules doesn't help. The only 
>>workaround is to stop asterisk on the NAT client for about 2 minutes. 
> 
> That is how it is. The -t nat table is only consulted for NEW connections.
> 
>>Why isn't this table deleted when ppp0 goes down?
> 
> netfilter does not know it has gone down, I think.

Unlike SNAT, isn't the MASQUERADE target supposed to delete obsolete 
masqueraded conntrack entries when the related interface goes down - or 
maybe when it goes up again with a different address ?

>>How can I force iptables to use ppp0's real IP address as sender IP in 
>>outgoing packets?
> 
> Flush the conntrack table when ppp0 has gone up (yes, up)

Why not when ppp0 has gone down ?