From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?ISO-8859-1?Q?Llu=EDs_Batlle?= Date: Wed, 06 Jul 2005 09:17:49 +0000 Subject: [LARTC] More on conntrack + NAT + mangle/nat tables Message-Id: <45219fb00507060217450a89ee@mail.gmail.com> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable To: lartc@mailman.ds9a.nl, netfilter@lists.netfilter.org I already understood that a packet enters chains in the 'nat' table only if it is the _first_ packet of a connection. In that case, we may do SNAT in the POSTROUTING chain of the 'nat' table. So, the packets arrive to the POSTROUTING chain of the 'mangle' table with the source IP address changed (if it's said by the rules of the 'nat' table). BUT, for the rest of the packets (not the first ones) of a connection, packets enter the POSTROUTING chain of the 'mangle' table _without_ a changed source IP address. Is this the expected behaviour of netfilter/conntrack? To me, it's quite strange. - I'm learning about the whole netfilter/policy router these days :) So I write a lot about that, which sounds strange to me. I hope I'm not annoying to the list. Thanks a lot. - Llu=EDs _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?ISO-8859-1?Q?Llu=EDs_Batlle?= Subject: More on conntrack + NAT + mangle/nat tables Date: Wed, 6 Jul 2005 11:17:49 +0200 Message-ID: <45219fb00507060217450a89ee@mail.gmail.com> Reply-To: =?ISO-8859-1?Q?Llu=EDs_Batlle?= Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1" To: lartc@mailman.ds9a.nl, netfilter@lists.netfilter.org I already understood that a packet enters chains in the 'nat' table only if it is the _first_ packet of a connection. In that case, we may do SNAT in the POSTROUTING chain of the 'nat' table. So, the packets arrive to the POSTROUTING chain of the 'mangle' table with the source IP address changed (if it's said by the rules of the 'nat' table). BUT, for the rest of the packets (not the first ones) of a connection, packets enter the POSTROUTING chain of the 'mangle' table _without_ a changed source IP address. Is this the expected behaviour of netfilter/conntrack? To me, it's quite strange. - I'm learning about the whole netfilter/policy router these days :) So I write a lot about that, which sounds strange to me. I hope I'm not annoying to the list. Thanks a lot. - Llu=EDs