Re: Unmatchable packet?

["Jesse Gordon" <jesseg@nikola.com>]

-----Original Message-----
From: Philip Craig <philipc@snapgear.com>
Subject: Re: Unmatchable packet?

> On 11/23/2005 11:46 AM, Jesse Gordon wrote:
> > I actually want to rewrite the source IP of TCP packets that exit a given 
> > ethernet card -- even (especially) if they are generated as responses 
> > to incoming connections to the box.
[Snip] 

> You can't do this with iptables.  NAT rules only match the first packet
> of a connection, and the NAT mapping that is determined for that first
> packet is applied to all subsequent packets in that connection.
> 
> Futhermore, it doesn't make sense to do this.  The client will receive
> packets from your arbitarily assigned source address, but will not know
> what to do with them since it never sent any packets to that address,
> and so it will just drop them.

Ahh, thanks! Can't be done. That explains my lack of success!

I agree -- to do as my little example showed would be useless -- but my
real goal is to route the reply traffic via a different route than the
request traffic -- I already got it to send the replies out a different
network interface then the requests came in, but I haven't yet figured out
how to rewrite the source address of the replies.

I only simplified the example so that no other unneeded data would
obfusticate what I was saying.

By using a second box with iptables as an inbetween gateway, or with proxy
arp filtering or ethernet bridging, I could probably do exactly what I
want. Perhaps I'll see what ebtables can do for me.

I don't quite understand why iptables wouldn't be able to match just any
packet going into or out of any given network card, regardless of whether
it was related to any other packet or not.

I may be a little confused. It seems to me that my experiments showed that
the act of permitting a certain packet criteria to exit a specified
ethernet port does not inherently permit the responses for that connection
back in. It seems to me that I had to either tell it to allow related in,
or specifically allow the replies back. I'll check into it more.

Thanks very much!

-Jesse Gordon