All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stephen Clark <sclark46@earthlink.net>
To: Netfilter Developer Mailing List <netfilter-devel@vger.kernel.org>
Subject: nat not working as expected
Date: Mon, 13 Aug 2012 13:50:25 -0400	[thread overview]
Message-ID: <50293E61.8080308@earthlink.net> (raw)

Hello,

I have a problem I am trying to solve and nat doesn't seem to be 
working. I have a set of ip addresses I don't
want to go thru my transparent proxy so I have the following:

  Chain PREROUTING (policy ACCEPT 1413 packets, 206K bytes)
  pkts bytes target     prot opt in     out     source               
destination
     0     0 ACCEPT     tcp  --  eth0   *       10.254.150.0/24      
10.0.0.0/8          tcp dpt:80
...
     0     0 ACCEPT     tcp  --  eth0   *       10.254.150.0/24      
8.15.7.123          tcp dpt:80
     2   120 ACCEPT     tcp  --  eth0   *       10.254.150.0/24      
216.16.243.121      tcp dpt:80
     0     0 ACCEPT     tcp  --  eth0   *       10.254.150.0/24      
216.16.242.222      tcp dpt:80
  ...
     0     0 ACCEPT     tcp  --  eth0   *       10.254.150.0/24      
216.171.106.210     tcp dpt:80
     0     0 DNAT       tcp  --  eth0   *       10.254.150.0/24      
0.0.0.0/0           tcp dpt:80 to:10.254.150.1:8080

Chain POSTROUTING (policy ACCEPT 922 packets, 81534 bytes)
  pkts bytes target     prot opt in     out     source               
destination
     0     0 ACCEPT     all  --  *      eth1    10.254.150.0/24      
10.0.0.0/8
     0     0 ACCEPT     all  --  *      eth1    10.254.150.0/24      
172.16.0.0/12
     0     0 ACCEPT     all  --  *      eth1    10.254.150.0/24      
192.168.0.0/16
     0     0 SNAT       all  --  *      eth1    10.254.150.0/24      
0.0.0.0/0           to:xxx.xxx.149.209

My packet hits the pre-routing chain and is accepted but then seems to 
get lost, it doesn't get
natted and go out my external interface.

tcpdump on internal interface:
13:33:03.157163 IP 10.254.150.91.53169 > 216.16.243.121.http: Flags [S], 
seq 1127713574, win 5840, options [mss 1460,sackOK,TS val 2344806144 ecr 
0,nop,wscale 6], length 0

nothing shows on external interface:

The routing looks correct.
$ ip r g 216.16.243.121
216.16.243.121 via xxx.xxx.149.1 dev eth1  src xxx.xxx.149.209


What am I missing?

Thanks for your indulgence,
Steve




             reply	other threads:[~2012-08-13 17:50 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-08-13 17:50 Stephen Clark [this message]
2012-08-13 17:57 ` nat not working as expected Stephen Clark

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=50293E61.8080308@earthlink.net \
    --to=sclark46@earthlink.net \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.