* FW: Packets missing the NAT table
@ 2013-01-06 16:08 Steve (Telsat Broadband)
2013-01-06 16:54 ` Jan Engelhardt
2013-01-06 17:08 ` Born Without
0 siblings, 2 replies; 4+ messages in thread
From: Steve (Telsat Broadband) @ 2013-01-06 16:08 UTC (permalink / raw)
To: netfilter
Hi All,
I’m just trying to debug an issue on our network and I’ve noticed that some
packets are being missed from some rules in the NAT table.
Do all packets go through the NAT table or is there some exclusion? I’m
seeing the packet hitting the mangle table as well as the filter table, but
not the NAT?
Thanks
Steve.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: FW: Packets missing the NAT table
2013-01-06 16:08 FW: Packets missing the NAT table Steve (Telsat Broadband)
@ 2013-01-06 16:54 ` Jan Engelhardt
2013-01-06 16:58 ` Steve (Telsat Broadband)
2013-01-06 17:08 ` Born Without
1 sibling, 1 reply; 4+ messages in thread
From: Jan Engelhardt @ 2013-01-06 16:54 UTC (permalink / raw)
To: Steve (Telsat Broadband); +Cc: netfilter
On Sunday 2013-01-06 17:08, Steve (Telsat Broadband) wrote:
>Hi All,
>
>I?m just trying to debug an issue on our network and I?ve noticed that some
>packets are being missed from some rules in the NAT table.
>
>Do all packets go through the NAT table or is there some exclusion? I?m
>seeing the packet hitting the mangle table as well as the filter table, but
>not the NAT?
The nat table is a configuration database of sorts that is only
consulted when necessary.
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: FW: Packets missing the NAT table
2013-01-06 16:54 ` Jan Engelhardt
@ 2013-01-06 16:58 ` Steve (Telsat Broadband)
0 siblings, 0 replies; 4+ messages in thread
From: Steve (Telsat Broadband) @ 2013-01-06 16:58 UTC (permalink / raw)
To: 'Jan Engelhardt'; +Cc: netfilter
Hi Jan,
Thanks for the quick reply.
That make sense; however now I just need to find a way to modify my rules to account for that :)
Thanks.
Steve.
-----Original Message-----
From: Jan Engelhardt [mailto:jengelh@inai.de]
Sent: Monday, 7 January 2013 3:55 AM
To: Steve (Telsat Broadband)
Cc: netfilter@vger.kernel.org
Subject: Re: FW: Packets missing the NAT table
On Sunday 2013-01-06 17:08, Steve (Telsat Broadband) wrote:
>Hi All,
>
>I?m just trying to debug an issue on our network and I?ve noticed that
>some packets are being missed from some rules in the NAT table.
>
>Do all packets go through the NAT table or is there some exclusion?
>I?m seeing the packet hitting the mangle table as well as the filter
>table, but not the NAT?
The nat table is a configuration database of sorts that is only consulted when necessary.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: FW: Packets missing the NAT table
2013-01-06 16:08 FW: Packets missing the NAT table Steve (Telsat Broadband)
2013-01-06 16:54 ` Jan Engelhardt
@ 2013-01-06 17:08 ` Born Without
1 sibling, 0 replies; 4+ messages in thread
From: Born Without @ 2013-01-06 17:08 UTC (permalink / raw)
To: Steve (Telsat Broadband); +Cc: netfilter
On 06.01.2013 17:08, Steve (Telsat Broadband) wrote:
> Hi All,
>
> I’m just trying to debug an issue on our network and I’ve noticed that some
> packets are being missed from some rules in the NAT table.
>
> Do all packets go through the NAT table or is there some exclusion? I’m
> seeing the packet hitting the mangle table as well as the filter table, but
> not the NAT?
What I've read in the past, the nat table is only consulted at
connection initiation for conntrack state NEW packets.
If conntrack qualifies a packet as INVALID this won't get natted and
sent out as is (if not dropped from another rule).
Try to catch the invalid packets with:
-m conntrack --ctstate INVALID
and see if these are the suspected ones.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-01-06 17:08 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-01-06 16:08 FW: Packets missing the NAT table Steve (Telsat Broadband)
2013-01-06 16:54 ` Jan Engelhardt
2013-01-06 16:58 ` Steve (Telsat Broadband)
2013-01-06 17:08 ` Born Without
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.