From: urgrue <urgrue@tumsan.fi>
To: linux-admin@vger.kernel.org
Subject: peculiar netfilter behaviour
Date: Thu, 16 Jan 2003 11:55:13 +0200 [thread overview]
Message-ID: <20030116095513.GA10056@fede2.tumsan.fi> (raw)
here's what happens:
i trace from my box A to address B.
a router on the way NATs the destination into Z.
the next router (X) sends back a ttl exceeded message (ie from X to A,
ttl exceeded), just as it should.
however, this ttl exceeded message is being natted! the router that NATs
is converting X into B??? why on earth is this? its definitely not my
NAT rules.
i can only assume it has something do with statefulness. a bug or a
feature?
in more detail:
my natting router:
Chain PREROUTING (policy ACCEPT)
DNAT all -- 0.0.0.0/0 address B to:address Z
Chain POSTROUTING (policy ACCEPT)
SNAT all -- address Z 0.0.0.0/0 to:address B
so trace shows:
traceroute to <address B> from <address A>, 30 hops max, 40 byte packets
1 <the NAT router> 4 ms 4 ms 4 ms
2 <address B> 4 ms 4 ms 4 ms
3 * * *
4
in fact nr.2 is NOT from B, as B isnt even on. with tcpdump i can see
that that mysterious number 2 packet is in fact
originally "from X to A" and after it passes my natting router it is
converted into "from Z to A".
any help on how to get around this undesired behaviour is appreciated.
urgrue
reply other threads:[~2003-01-16 9:55 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030116095513.GA10056@fede2.tumsan.fi \
--to=urgrue@tumsan.fi \
--cc=linux-admin@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).