From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?ISO-8859-1?Q?Pedro_Gon=E7alves?= Subject: IPTables NAT: Strange behaviour: bug? Date: Tue, 24 Apr 2007 09:40:00 +0100 Message-ID: <462DC260.5090206@gmail.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------000805060202040601080300" Return-path: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org To: Mail List - Netfilter This is a multi-part message in MIME format. --------------000805060202040601080300 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi everyone I'm using IPTables to provide me a Port Restricted Cone NAT. According to STUN RFC, in a Port Restricted Cone NAT "all requests from the same internal IP address and port are mapped to the same IP address and port" (using all policies set to ACCEPT and the following rule: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE) My scenario is the following: -Client behind NAT: IP = 175.16.0.1 -NAT public addr = 192.168.2.159 This client will talk with two different destination addresses: -192.168.2.164 (Stun server) -192.168.2.173 (Other NAT's public addr) In attachment you can find an capture made at the machine with IPTables, in which you can see: -packets 1 and 2: Packet going from the client behind NAT (175.16.0.1:10000) to Stun Server (192.168.2.164:3478) -> Client's public address is 192.168.2.159:10000 -packets 21 e 22: Packet going from the client behind NAT (175.16.0.1:10000) to the other NAT's public addr (192.168.2.173:20000)-> Client's public address is 192.168.2.159:1029 Why is the client getting different NAT mappings? Why is the mapping changing from 175.16.0.1:10000 -> 192.168.2.159:10000 to 175.16.0.1:10000 -> 192.168.2.159:1029 ? Best Regards Pedro --------------000805060202040601080300 Content-Type: application/octet-stream; name="nat_strange_behaviour_.pcap" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="nat_strange_behaviour_.pcap" 1MOyoQIABAAAAAAAAAAAAP//AAABAAAAaOUsRmFVAwBGAAAARgAAAAAZ0QHELAAMKZTmHAgA RQAAOAFeAAB/EbPDwKgCn8CoAqQnEA2WACQtbwABAAgQUOSv+FPJCC2EZ3Psld8CAAMABAAA AABo5SxGwlUDAEYAAABGAAAAAAwplOYmAAI/vdoKCABFAAA4AV4AAIARxvmvEAABwKgCpCcQ DZYAJEGlAAEACBBQ5K/4U8kILYRnc+yV3wIAAwAEAAAAAGjlLEZRwgMAggAAAIIAAAAADCmU 5hwAGdEBxCwIAEUAAHRzBwAAgBFA3sCoAqTAqAKfDZYnEABgWjkBAQBEEFDkr/hTyQgthGdz 7JXfAgABAAgAAScQwKgCnwAEAAgAAQ2WwKgCpAAFAAgAAQ2XwKgCqYAgAAgAATdA0PjmMIAi ABBWb3ZpZGEub3JnIDAuOTYAaOUsRi3DAwCCAAAAggAAAAACP73aCgAMKZTmJggARQAAdHMH AAB/EVYUwKgCpK8QAAENlicQAGBubwEBAEQQUOSv+FPJCC2EZ3Psld8CAAEACAABJxDAqAKf AAQACAABDZbAqAKkAAUACAABDZfAqAKpgCAACAABN0DQ+OYwgCIAEFZvdmlkYS5vcmcgMC45 NgBo5SxGxRgEAEYAAABGAAAAAAwplOYmAAI/vdoKCABFAAA4AV8AAIARxvivEAABwKgCpCcR DZYAJPpxAAEACDB77a/4U8kINncUNdSpX0EAAwAEAAAAAGjlLEbqjQQAggAAAIIAAAAAAj+9 2goADCmU5iYIAEUAAHRzDAAAfxFWD8CoAqSvEAABDZYnEQBgHjYBAQBEMHvtr/hTyQg2dxQ1 1KlfQQABAAgAAScRwKgCnwAEAAgAAQ2WwKgCpAAFAAgAAQ2XwKgCqYAgAAgAARdq8NPvMIAi ABBWb3ZpZGEub3JnIDAuOTYAaOUsRkjTBABGAAAARgAAAAAMKZTmJgACP73aCggARQAAOAFg AACAEcb3rxAAAcCoAqQnEg2WACRIYQABAAggH/Wv+FPJCKBuvxbaF/9lAAMABAAAAABo5SxG m9MEAEYAAABGAAAAABnRAcQsAAwplOYcCABFAAA4AWAAAH8Rs8HAqAKfwKgCpCcSDZYAJDQr AAEACCAf9a/4U8kIoG6/FtoX/2UAAwAEAAAAAGjlLEZTRwUAggAAAIIAAAAADCmU5hwAGdEB xCwIAEUAAHRzDQAAgBFA2MCoAqTAqAKfDZYnEgBgcGcBAQBEIB/1r/hTyQigbr8W2hf/ZQAB AAgAAScSwKgCnwAEAAgAAQ2WwKgCpAAFAAgAAQ2XwKgCqYAgAAgAAQcN4Lf3MIAiABBWb3Zp ZGEub3JnIDAuOTYAaOUsRtlHBQCCAAAAggAAAAACP73aCgAMKZTmJggARQAAdHMNAAB/EVYO wKgCpK8QAAENlicSAGCEnQEBAEQgH/Wv+FPJCKBuvxbaF/9lAAEACAABJxLAqAKfAAQACAAB DZbAqAKkAAUACAABDZfAqAKpgCAACAABBw3gt/cwgCIAEFZvdmlkYS5vcmcgMC45NgBo5SxG MI4FAEYAAABGAAAAAAwplOYmAAI/vdoKCABFAAA4AWEAAIARxvavEAABwKgCpCcTDZYAJG8F AAEACBDD/K/4U8kIwG53GZEtUgQAAwAEAAAAAGjlLEa7AgYAggAAAIIAAAAAAj+92goADCmU 5iYIAEUAAHRzEgAAfxFWCcCoAqSvEAABDZYnEwBgg8kBAQBEEMP8r/hTyQjAbncZkS1SBAAB AAgAAScTwKgCnwAEAAgAAQ2WwKgCpAAFAAgAAQ2XwKgCqYAgAAgAATfQ0Gv+MIAiABBWb3Zp ZGEub3JnIDAuOTYAaOUsRoQRBwBGAAAARgAAAAAZ0QHELAAMKUpe+wgARQAAOEQlAAB/EXDu wKgCrcCoAqROIA2WACQ6GQABAAgC89KR+FPJCNECJjLcnnhvAAMABAAAAABo5SxGzIkHAIIA AACCAAAAAAwpSl77ABnRAcQsCABFAAB0cxkAAIARQL7AqAKkwKgCrQ2WTiAAYE7DAQEARALz 0pH4U8kI0QImMtyeeG8AAQAIAAFOIMCoAq0ABAAIAAENlsCoAqQABQAIAAENl8CoAqmAIAAI AAFM08Jb0DyAIgAQVm92aWRhLm9yZyAwLjk2AGjlLEb34ggARgAAAEYAAAAAGdEBxCwADClK XvsIAEUAADhEJwAAfxFw7MCoAq3AqAKkTiINlgAkak4AAQAIeKPjkfhTyQhAxfNoGwlGJAAD AAQAAAAAaOUsRrJsCQCCAAAAggAAAAAMKUpe+wAZ0QHELAgARQAAdHMfAACAEUC4wKgCpMCo Aq0Nlk4iAGCOmAEBAER4o+OR+FPJCEDF82gbCUYkAAEACAABTiLAqAKtAAQACAABDZbAqAKk AAUACAABDZfAqAKpgCAACAABNoG4C+E8gCIAEFZvdmlkYS5vcmcgMC45NgBo5SxG5NsLAHIA AAByAAAAAAwplOYcAAwpSl77CABFAABkRCsAAH8RcMHAqAKtwKgCn04gJxAAUB8XAAEANFbd /ZH4U8kIimAYZNkQhVoAAwAEAAAAAAAGAAw3YjY4OjgzZWsgICAAJQAAAAgAFLbOttbMz7mD LDXYNzURV71bKYYIaOUsRufbCwCOAAAAjgAAAAAMKUpe+wAMKZTmHAgARcAAgBLKAABAAeBW wKgCn8CoAq0DA4P7AAAAAEUAAGREKwAAfxFwwcCoAq3AqAKfTiAnEABQHxcAAQA0Vt39kfhT yQiKYBhk2RCFWgADAAQAAAAAAAYADDdiNjg6ODNlayAgIAAlAAAACAAUts621szPuYMsNdg3 NRFXvVsphgho5SxGszwNAHIAAAByAAAAAAwplOYmAAI/vdoKCABFAABkAWUAAIAR2QGvEAAB sRAAAScQTiAAUKeuAAEANJDiObD4U8kIMSeCXWU7LXgAAwAEAAAAAAAGAAw4M2VrOjdiNjgg ICAAJQAAAAgAFP/xFfHu5vshkqCXb/tx3mVWI8NRaOUsRpo/DQByAAAAcgAAAABQ/KIjxQAM KZTmHAgARQAAZAFlAAB/EcXLwKgCn7EQAAEnEE4gAFCTeAABADSQ4jmw+FPJCDEngl1lOy14 AAMABAAAAAAABgAMODNlazo3YjY4ICAgACUAAAAIABT/8RXx7ub7IZKgl2/7cd5lViPDUWjl LEZhTA0AcgAAAHIAAAAADCmU5iYAAj+92goIAEUAAGQBZgAAgBHGvK8QAAHAqAKtJxBOIABQ Y0UAAQA0sA1DsPhTyQiebPxGjMk/RwADAAQAAAAAAAYADDgzZWs6N2I2OCAgIAAlAAAACAAU CoYXiurZvHAoPG9nTfgWFjomBoRo5SxGjkwNAHIAAAByAAAAAAwpSl77AAwplOYcCABFAABk AWYAAH8Rs4bAqAKfwKgCrQQFTiAAUHIaAAEANLANQ7D4U8kInmz8RozJP0cAAwAEAAAAAAAG AAw4M2VrOjdiNjggICAAJQAAAAgAFAqGF4rq2bxwKDxvZ034FhY6JgaEaOUsRgpQDQCOAAAA jgAAAAAMKZTmHAAMKUpe+wgARcAAgPGZAABAAQGHwKgCrcCoAp8DA4P7AAAAAEUAAGQBZgAA fxGzhsCoAp/AqAKtBAVOIABQchoAAQA0sA1DsPhTyQiebPxGjMk/RwADAAQAAAAAAAYADDgz ZWs6N2I2OCAgIAAlAAAACAAUCoYXiurZvHAoPG9nTfgWFjomBoRo5SxGslANAI4AAACOAAAA AAI/vdoKAAwplOYmCABFwACA8ZkAAD8BFr3AqAKtrxAAAQMDb8UAAAAARQAAZAFmAAB/Ece8 rxAAAcCoAq0nEE4gAFBjRQABADSwDUOw+FPJCJ5s/EaMyT9HAAMABAAAAAAABgAMODNlazo3 YjY4ICAgACUAAAAIABQKhheK6tm8cCg8b2dN+BYWOiYGhGjlLEb4Pw8AcgAAAHIAAAAADCmU 5hwADClKXvsIAEUAAGRELQAAfxFwv8CoAq3AqAKfTiAnEABQHxcAAQA0Vt39kfhTyQiKYBhk 2RCFWgADAAQAAAAAAAYADDdiNjg6ODNlayAgIAAlAAAACAAUts621szPuYMsNdg3NRFXvVsp hgho5SxGMUAPAI4AAACOAAAAAAwpSl77AAwplOYcCABFwACAEssAAEAB4FXAqAKfwKgCrQMD g/sAAAAARQAAZEQtAAB/EXC/wKgCrcCoAp9OICcQAFAfFwABADRW3f2R+FPJCIpgGGTZEIVa AAMABAAAAAAABgAMN2I2ODo4M2VrICAgACUAAAAIABS2zrbWzM+5gyw12Dc1EVe9WymGCGnl LEZl2AAAcgAAAHIAAAAADCmU5iYAAj+92goIAEUAAGQBZwAAgBHGu68QAAHAqAKtJxBOIABQ Y0UAAQA0sA1DsPhTyQiebPxGjMk/RwADAAQAAAAAAAYADDgzZWs6N2I2OCAgIAAlAAAACAAU CoYXiurZvHAoPG9nTfgWFjomBoRp5SxGztgAAHIAAAByAAAAAAwpSl77AAwplOYcCABFAABk AWcAAH8Rs4XAqAKfwKgCrQQFTiAAUHIaAAEANLANQ7D4U8kInmz8RozJP0cAAwAEAAAAAAAG AAw4M2VrOjdiNjggICAAJQAAAAgAFAqGF4rq2bxwKDxvZ034FhY6JgaEaeUsRhfaAACOAAAA jgAAAAAMKZTmHAAMKUpe+wgARcAAgPGaAABAAQGGwKgCrcCoAp8DA4P7AAAAAEUAAGQBZwAA fxGzhcCoAp/AqAKtBAVOIABQchoAAQA0sA1DsPhTyQiebPxGjMk/RwADAAQAAAAAAAYADDgz ZWs6N2I2OCAgIAAlAAAACAAUCoYXiurZvHAoPG9nTfgWFjomBoRp5SxGt9oAAI4AAACOAAAA AAI/vdoKAAwplOYmCABFwACA8ZoAAD8BFrzAqAKtrxAAAQMDb8UAAAAARQAAZAFnAAB/Ece7 rxAAAcCoAq0nEE4gAFBjRQABADSwDUOw+FPJCJ5s/EaMyT9HAAMABAAAAAAABgAMODNlazo3 YjY4ICAgACUAAAAIABQKhheK6tm8cCg8b2dN+BYWOiYGhGnlLEYy3QAAcgAAAHIAAAAADCmU 5iYAAj+92goIAEUAAGQBaAAAgBHY/q8QAAGxEAABJxBOIABQp64AAQA0kOI5sPhTyQgxJ4Jd ZTsteAADAAQAAAAAAAYADDgzZWs6N2I2OCAgIAAlAAAACAAU//EV8e7m+yGSoJdv+3HeZVYj w1Fp5SxGW90AAHIAAAByAAAAAFD8oiPFAAwplOYcCABFAABkAWgAAH8RxcjAqAKfsRAAAScQ TiAAUJN4AAEANJDiObD4U8kIMSeCXWU7LXgAAwAEAAAAAAAGAAw4M2VrOjdiNjggICAAJQAA AAgAFP/xFfHu5vshkqCXb/tx3mVWI8NRaeUsRgsPAwByAAAAcgAAAAAMKZTmHAAMKUpe+wgA RQAAZEQvAAB/EXC9wKgCrcCoAp9OICcQAFAfFwABADRW3f2R+FPJCIpgGGTZEIVaAAMABAAA AAAABgAMN2I2ODo4M2VrICAgACUAAAAIABS2zrbWzM+5gyw12Dc1EVe9WymGCGnlLEZDDwMA jgAAAI4AAAAADClKXvsADCmU5hwIAEXAAIASzAAAQAHgVMCoAp/AqAKtAwOD+wAAAABFAABk RC8AAH8RcL3AqAKtwKgCn04gJxAAUB8XAAEANFbd/ZH4U8kIimAYZNkQhVoAAwAEAAAAAAAG AAw3YjY4OjgzZWsgICAAJQAAAAgAFLbOttbMz7mDLDXYNzURV71bKYYIaeUsRh2+AwByAAAA cgAAAAAMKZTmJgACP73aCggARQAAZAFpAACAEca5rxAAAcCoAq0nEE4gAFBjRQABADSwDUOw +FPJCJ5s/EaMyT9HAAMABAAAAAAABgAMODNlazo3YjY4ICAgACUAAAAIABQKhheK6tm8cCg8 b2dN+BYWOiYGhGnlLEZQvgMAcgAAAHIAAAAADClKXvsADCmU5hwIAEUAAGQBaQAAfxGzg8Co Ap/AqAKtBAVOIABQchoAAQA0sA1DsPhTyQiebPxGjMk/RwADAAQAAAAAAAYADDgzZWs6N2I2 OCAgIAAlAAAACAAUCoYXiurZvHAoPG9nTfgWFjomBoRp5SxGp78DAI4AAACOAAAAAAwplOYc AAwpSl77CABFwACA8ZsAAEABAYXAqAKtwKgCnwMDg/sAAAAARQAAZAFpAAB/EbODwKgCn8Co Aq0EBU4gAFByGgABADSwDUOw+FPJCJ5s/EaMyT9HAAMABAAAAAAABgAMODNlazo3YjY4ICAg ACUAAAAIABQKhheK6tm8cCg8b2dN+BYWOiYGhGnlLEYiwAMAjgAAAI4AAAAAAj+92goADCmU 5iYIAEXAAIDxmwAAPwEWu8CoAq2vEAABAwNvxQAAAABFAABkAWkAAH8Rx7mvEAABwKgCrScQ TiAAUGNFAAEANLANQ7D4U8kInmz8RozJP0cAAwAEAAAAAAAGAAw4M2VrOjdiNjggICAAJQAA AAgAFAqGF4rq2bxwKDxvZ034FhY6JgaEaeUsRlXDAwByAAAAcgAAAAAMKZTmJgACP73aCggA RQAAZAFqAACAEdj8rxAAAbEQAAEnEE4gAFCnrgABADSQ4jmw+FPJCDEngl1lOy14AAMABAAA AAAABgAMODNlazo3YjY4ICAgACUAAAAIABT/8RXx7ub7IZKgl2/7cd5lViPDUWnlLEaJwwMA cgAAAHIAAAAAUPyiI8UADCmU5hwIAEUAAGQBagAAfxHFxsCoAp+xEAABJxBOIABQk3gAAQA0 kOI5sPhTyQgxJ4JdZTsteAADAAQAAAAAAAYADDgzZWs6N2I2OCAgIAAlAAAACAAU//EV8e7m +yGSoJdv+3HeZVYjw1E= --------------000805060202040601080300--