From: "H. Peter Anvin" <hpa@zytor.com>
To: Bernardo Innocenti <bernie@develer.com>
Cc: Cristian Grigoriu <cristian.grigoriu@provus.ro>,
b.innocenti@develer.com, lkml <linux-kernel@vger.kernel.org>
Subject: Re: NAT failure with TCP, too
Date: Sun, 22 Oct 2006 16:53:20 -0700 [thread overview]
Message-ID: <453C0470.6090503@zytor.com> (raw)
In-Reply-To: <453C01AE.7060103@develer.com>
Bernardo Innocenti wrote:
>
>
> Cristian Grigoriu wrote:
>> Hi,
>>
>> I can confirm the same bug you reported here
>> http://www.ussg.iu.edu/hypermail/linux/kernel/0509.2/0279.html
>> This time it happens with TCP connections originating from the same
>> TCP port (1234) from multiple machines. The SNAT simply doesn't take
>> place and the normal routing occurs.
>>
>> Kernel is Debian stock 2.6.18-1.
>>
>> Please let me know if you have find a workaround.
>
> It turned out that the real thing that was triggering the bug
> for me was unloading and reloading the ip_nat module without
> also reloading ip_conntrack.
>
> The connection tracking tuple would remain in the kernel, visible
> in /proc/net/ip_conntrack, but no longer linked to the SNAT rule.
> I'd consider this a bug, but very few users will ever be affected.
>
> The workaround for me was to remove my hand-cracted iptables
> rules from ppp's ip-up.local and move them to the distro-supplied
> iptables firewall instead. The only downside is that I must now
> hardcode the destination ip of the SNAT rule because it's too early
> to read the interface address of ppp0.
>
You may want to use the MASQUERADE target instead of the SNAT target.
-hpa
prev parent reply other threads:[~2006-10-22 23:53 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <4538B314.2020309@provus.ro>
2006-10-22 23:41 ` NAT failure with TCP, too Bernardo Innocenti
2006-10-22 23:53 ` H. Peter Anvin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=453C0470.6090503@zytor.com \
--to=hpa@zytor.com \
--cc=b.innocenti@develer.com \
--cc=bernie@develer.com \
--cc=cristian.grigoriu@provus.ro \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.