* peculiar netfilter behaviour
@ 2003-01-16 9:55 urgrue
0 siblings, 0 replies; only message in thread
From: urgrue @ 2003-01-16 9:55 UTC (permalink / raw)
To: linux-admin
here's what happens:
i trace from my box A to address B.
a router on the way NATs the destination into Z.
the next router (X) sends back a ttl exceeded message (ie from X to A,
ttl exceeded), just as it should.
however, this ttl exceeded message is being natted! the router that NATs
is converting X into B??? why on earth is this? its definitely not my
NAT rules.
i can only assume it has something do with statefulness. a bug or a
feature?
in more detail:
my natting router:
Chain PREROUTING (policy ACCEPT)
DNAT all -- 0.0.0.0/0 address B to:address Z
Chain POSTROUTING (policy ACCEPT)
SNAT all -- address Z 0.0.0.0/0 to:address B
so trace shows:
traceroute to <address B> from <address A>, 30 hops max, 40 byte packets
1 <the NAT router> 4 ms 4 ms 4 ms
2 <address B> 4 ms 4 ms 4 ms
3 * * *
4
in fact nr.2 is NOT from B, as B isnt even on. with tcpdump i can see
that that mysterious number 2 packet is in fact
originally "from X to A" and after it passes my natting router it is
converted into "from Z to A".
any help on how to get around this undesired behaviour is appreciated.
urgrue
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2003-01-16 9:55 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-01-16 9:55 peculiar netfilter behaviour urgrue
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).