conntrackd external cache does not contain NAT information

conntrackd external cache does not contain NAT information

[Egon Burgener]

Hi

I am building a firewall with
   kernel 2.6.29.6
   iptables 2.4.4
   conntrack-tools 0.9.13 (FTFW mode)
   heartbeat version 1

conntrack synchronisation works fine except NAT traffic. If I do
conntrackd -i on the active node I see the NAT information in it:

tcp      6 ESTABLISHED src=192.168.12.20 dst=12.129.147.65 sport=2403  
dport=80 src=12.129.147.65 dst=84.73.54.61 sport=80 dport=2403  
[ASSURED] [active since 48s]

On the standby node I am missing the NAT information (conntrackd -e):

tcp      6 ESTABLISHED src=192.168.12.20 dst=12.129.147.65 sport=2403  
dport=80 [ASSURED] [active since 91s]

Has anybody a hint?

Thx
Egon
-- 
-----------------------------------------------------------------------------------------
addr://Kasinostrasse 30, CH-5001 Aarau   fon://++41 62 823 9355
http://www.terreactive.com                             fax://++41 62  
823 9356
------------------------------------------------------------------------------------------
Wir sichern Ihren Erfolg.                                 terreActive AG
------------------------------------------------------------------------------------------

Re: conntrackd external cache does not contain NAT information

[Pablo Neira Ayuso]

Hi,

Egon Burgener wrote:
> Hi
> 
> I am building a firewall with
>   kernel 2.6.29.6
>   iptables 2.4.4
>   conntrack-tools 0.9.13 (FTFW mode)
>   heartbeat version 1
> 
> conntrack synchronisation works fine except NAT traffic. If I do
> conntrackd -i on the active node I see the NAT information in it:
> 
> tcp      6 ESTABLISHED src=192.168.12.20 dst=12.129.147.65 sport=2403
> dport=80 src=12.129.147.65 dst=84.73.54.61 sport=80 dport=2403 [ASSURED]
> [active since 48s]
> 
> On the standby node I am missing the NAT information (conntrackd -e):
> 
> tcp      6 ESTABLISHED src=192.168.12.20 dst=12.129.147.65 sport=2403
> dport=80 [ASSURED] [active since 91s]
> 
> Has anybody a hint?

The NAT information is there but not listed when you do `conntrackd -e'
but it's built during the commit phase that occurs when your HA manager
calls `conntrackd -c' (see the primary-backup.sh script).

You can verify this by invoking `conntrack -L' to see the result of the
commit. You should see the NAT information at that stage.

Re: conntrackd external cache does not contain NAT information

[Egon Burgener]

Hi  Pablo

Yes, you are right. The NAT information is not displayed with  
conntrackd -e but is there and gets pushed into the conntrack table  
with conntrackd -c.
Therefore, my NAT sync problem is somewhere else. I have to debug  
further.

Thanks for your assistance
Egon


On Aug 21, 2009, at 4:28 PM, Pablo Neira Ayuso wrote:

> Hi,
>
> Egon Burgener wrote:
>> Hi
>>
>> I am building a firewall with
>>  kernel 2.6.29.6
>>  iptables 2.4.4
>>  conntrack-tools 0.9.13 (FTFW mode)
>>  heartbeat version 1
>>
>> conntrack synchronisation works fine except NAT traffic. If I do
>> conntrackd -i on the active node I see the NAT information in it:
>>
>> tcp      6 ESTABLISHED src=192.168.12.20 dst=12.129.147.65 sport=2403
>> dport=80 src=12.129.147.65 dst=84.73.54.61 sport=80 dport=2403  
>> [ASSURED]
>> [active since 48s]
>>
>> On the standby node I am missing the NAT information (conntrackd -e):
>>
>> tcp      6 ESTABLISHED src=192.168.12.20 dst=12.129.147.65 sport=2403
>> dport=80 [ASSURED] [active since 91s]
>>
>> Has anybody a hint?
>
> The NAT information is there but not listed when you do `conntrackd - 
> e'
> but it's built during the commit phase that occurs when your HA  
> manager
> calls `conntrackd -c' (see the primary-backup.sh script).
>
> You can verify this by invoking `conntrack -L' to see the result of  
> the
> commit. You should see the NAT information at that stage.
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter"  
> in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

-- 
-----------------------------------------------------------------------------------------
addr://Kasinostrasse 30, CH-5001 Aarau   fon://++41 62 823 9355
http://www.terreactive.com                             fax://++41 62  
823 9356
------------------------------------------------------------------------------------------
Wir sichern Ihren Erfolg.                                 terreActive AG
------------------------------------------------------------------------------------------