From: Ulrich Weber <ulrich.weber@sophos.com>
To: netfilter@vger.kernel.org
Subject: Re: How to use IPv6 SNPT?
Date: Fri, 21 Dec 2012 16:00:06 +0100 [thread overview]
Message-ID: <50D47976.6090409@sophos.com> (raw)
In-Reply-To: <50D1ADEE.8010805@logix.net.nz>
Hi Michael,
NAT table is only called once for each connection.
Since you use stateless NAT better use the mangle table.
Cheers
Ulrich
On 12/19/12 13:07, Michael Ludvig wrote:
> Hi guys
>
> I did some experimenting with the new NAT support for IPv6 and was quite
> impressed how smoothly MASQUERADE and SNAT work.
>
> However I didn't have any success with IPv6 SNPT. As I understand it
> SNPT is meant for 1:1 address translation and should simply replace src
> prefix with dst prefix.
>
> For testing I use fd00::/64 address range in my VirtualBox network with
> SLAAC addresses.
>
> ip6tables -t nat -I POSTROUTING -s fd00::/64 \
> -j SNPT --src-pfx fd00::/64 --dst-pfx 2001:e20:2000:xx::/64
>
> The strange thing is that only the first ping6 packet to google is
> translated, the subsequent ones on the external interface are still in
> fd00::/64:
>
> Seq 1 - translated:
> 00:49:25.699206 IP6 2001:e20:2000:xx:b5d0:27ff:feec:3987 > \
> 2404:6800:4006:804::1017: ICMP6, echo request, seq 1, length 64
>
> Seq 2&3 - untranslated source:
> 00:49:26.699498 IP6 fd00::a00:27ff:feec:3987 > \
> 2404:6800:4006:804::1017: ICMP6, echo request, seq 2, length 64
> 00:49:27.699436 IP6 fd00::a00:27ff:feec:3987 > \
> 2404:6800:4006:804::1017: ICMP6, echo request, seq 3, length 64
>
> Once I remove the SNPT rule and replace it with a simple -j MASQUERADE
> it begins to work. Forwarding is obviously enabled and no other firewall
> rules are in place (neither in 'nat' table nor elsewhere). My kernel is
> 3.7.0-rc8, iptables from the current git checkout.
>
> What am I doing wrong?
>
> Thanks!
>
> Michael
>
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Ulrich Weber | ulrich.weber@sophos.com | Senior Software Engineer
Astaro - a Sophos company | Amalienbadstr 41 | 76227 Karlsruhe | Germany
Phone +49-721-25516-0 | Fax –200 | www.astaro.com
next prev parent reply other threads:[~2012-12-21 15:00 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-12-19 12:07 How to use IPv6 SNPT? Michael Ludvig
2012-12-21 15:00 ` Ulrich Weber [this message]
2012-12-30 10:37 ` Michael Ludvig
2013-01-02 16:18 ` Ulrich Weber
2013-05-01 13:10 ` Alex
2013-05-02 8:12 ` Alex
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50D47976.6090409@sophos.com \
--to=ulrich.weber@sophos.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.