From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Rob Sterenborg (lists)" Subject: Re: nat ftp helper bypass Date: Tue, 08 Oct 2013 09:36:04 +0200 Message-ID: <5253B5E4.1050103@sterenborg.info> References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Anand Raj Manickam Cc: netfilter@vger.kernel.org On 10/08/2013 07:46 AM, Anand Raj Manickam wrote: > Is there a way to bypass nat ftp helper for a few connections and > allow the rest of the FTP connections to NAT with the FTP helper > module ? > The need is to NAT the FTP control and data connections without > conntrack-helpers . See man iptables, specifically the raw table: raw: This table is used mainly for configuring exemptions from connection tracking in combination with the NOTRACK target. It registers at the netfilter hooks with higher priority and is thus called before ip_conntrack, or any other IP tables. It provides the following built-in chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets generated by local processes) -- Rob