From: Born Without <blackhole@airpost.net>
To: "Steve (Telsat Broadband)" <steve@telsatbb.vu>
Cc: netfilter@vger.kernel.org
Subject: Re: FW: Packets missing the NAT table
Date: Sun, 06 Jan 2013 18:08:23 +0100 [thread overview]
Message-ID: <50E9AF87.7070403@airpost.net> (raw)
In-Reply-To: <00a901cdec28$006d1c10$01475430$@telsatbb.vu>
On 06.01.2013 17:08, Steve (Telsat Broadband) wrote:
> Hi All,
>
> I’m just trying to debug an issue on our network and I’ve noticed that some
> packets are being missed from some rules in the NAT table.
>
> Do all packets go through the NAT table or is there some exclusion? I’m
> seeing the packet hitting the mangle table as well as the filter table, but
> not the NAT?
What I've read in the past, the nat table is only consulted at
connection initiation for conntrack state NEW packets.
If conntrack qualifies a packet as INVALID this won't get natted and
sent out as is (if not dropped from another rule).
Try to catch the invalid packets with:
-m conntrack --ctstate INVALID
and see if these are the suspected ones.
prev parent reply other threads:[~2013-01-06 17:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-06 16:08 FW: Packets missing the NAT table Steve (Telsat Broadband)
2013-01-06 16:54 ` Jan Engelhardt
2013-01-06 16:58 ` Steve (Telsat Broadband)
2013-01-06 17:08 ` Born Without [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50E9AF87.7070403@airpost.net \
--to=blackhole@airpost.net \
--cc=netfilter@vger.kernel.org \
--cc=steve@telsatbb.vu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.