[LARTC] More on conntrack + NAT + mangle/nat tables

[LARTC] More on conntrack + NAT + mangle/nat tables

[Lluís Batlle]

I already understood that a packet enters chains in the 'nat' table
only if it is the _first_ packet of a connection. In that case, we may
do SNAT in the POSTROUTING chain of the 'nat' table.
So, the packets arrive to the POSTROUTING chain of the 'mangle' table
with the source IP address changed (if it's said by the rules of the
'nat' table).

BUT, for the rest of the packets (not the first ones) of a connection,
packets enter the POSTROUTING chain of the 'mangle' table _without_ a
changed source IP address. Is this the expected behaviour of
netfilter/conntrack?

To me, it's quite strange.

- I'm learning about the whole netfilter/policy router these days :)
So I write a lot about that, which sounds strange to me. I hope I'm
not annoying to the list.

Thanks a lot.

- Lluís
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

More on conntrack + NAT + mangle/nat tables

[Lluís Batlle]

I already understood that a packet enters chains in the 'nat' table
only if it is the _first_ packet of a connection. In that case, we may
do SNAT in the POSTROUTING chain of the 'nat' table.
So, the packets arrive to the POSTROUTING chain of the 'mangle' table
with the source IP address changed (if it's said by the rules of the
'nat' table).

BUT, for the rest of the packets (not the first ones) of a connection,
packets enter the POSTROUTING chain of the 'mangle' table _without_ a
changed source IP address. Is this the expected behaviour of
netfilter/conntrack?

To me, it's quite strange.

- I'm learning about the whole netfilter/policy router these days :)
So I write a lot about that, which sounds strange to me. I hope I'm
not annoying to the list.

Thanks a lot.

- Lluís

Re: More on conntrack + NAT + mangle/nat tables

[Jörg Harmuth]

Lluís Batlle schrieb:
> I already understood that a packet enters chains in the 'nat' table
> only if it is the _first_ packet of a connection. In that case, we may
> do SNAT in the POSTROUTING chain of the 'nat' table.
> So, the packets arrive to the POSTROUTING chain of the 'mangle' table
> with the source IP address changed (if it's said by the rules of the
> 'nat' table).

No. According to the picture found at

http://iptables-tutorial.frozentux.net/chunkyhtml/traversingoftables.html

packet flow is:

... --> [mangle:POSTROUTING] --> [nat:POSTROUTING]

So, all packets arrive in mangle:POSTROUTING with their source address
unchanged. DNAT - if configured - is already applied to the packet.

If I'm telling old stories now, forget it, but you can modify this
script to fit your needs:

http://iptables-tutorial.frozentux.net/scripts/rc.test-iptables.txt

Following the log (and /proc/net/ip_conntrack) you see the packet flow
in detail. And you see when [S|D]NAT ist applied.

> - I'm learning about the whole netfilter/policy router these days :)
> So I write a lot about that, which sounds strange to me. I hope I'm
> not annoying to the list.

I can only speak for myself - no, you aren't :)

Have a nice time,

Joerg

Re: More on conntrack + NAT + mangle/nat tables

[Lluís Batlle]

Oh, my fault. :) I mislooked at the diagram :) Everything is fine, so,
about nat + mangle tables.
So, I think conntrack NAT happens after the mangle POSTROUTING chain.
So, after routing.

Thanks :)

On 7/6/05, Jörg Harmuth <harmuth@mnemon.de> wrote:
> packet flow is:
> 
> ... --> [mangle:POSTROUTING] --> [nat:POSTROUTING]
> 
> So, all packets arrive in mangle:POSTROUTING with their source address
> unchanged. DNAT - if configured - is already applied to the packet.
> 
> If I'm telling old stories now, forget it, but you can modify this
> script to fit your needs:
> 
> http://iptables-tutorial.frozentux.net/scripts/rc.test-iptables.txt
> 
> Following the log (and /proc/net/ip_conntrack) you see the packet flow
> in detail. And you see when [S|D]NAT ist applied.