Re: NAT on stateless firewall ?

[Grant Taylor <gtaylor@riverviewtech.net>]

On 08/06/07 00:01, Martijn Lievaart wrote:
> The sender wants to send a packet. It uses arp to find out which MAC to
> send to. It sends it. The packet arrives at the destination nic. That's
> all I ment, not more, not less.

Ok, agreed.  The only thing I'll add is that ARP is one way for the
sender to identify the MAC to send the packet to, there are other ways too.

> However, having arrived at the nic, the packet is then transfered to the
> stack. If the stack does not know about the destination IP, the packet
> is dropped by routing, iirc. However, before routing (in PREROUTING) the
> destination is changed to something the stack does know about. So how
> comes it does not work?

I would think that this could work if you caught the packet in time to
re-direct it elsewhere.  I will have to go back and re-read this thread
to better respond later (when I have time).  At the moment, I agree that
this should work if it is implemented correctly.

So long as you can direct the packet where you want to and there is no
firewalling and / or kernel based filtering like reverse path filters
causing the low level networking to drop the packets this should work.
In fact, the receiving hosts actions is this is the bases for many
different solutions.



Grant. . . .