linux-admin.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* peculiar netfilter behaviour
@ 2003-01-16  9:55 urgrue
  0 siblings, 0 replies; only message in thread
From: urgrue @ 2003-01-16  9:55 UTC (permalink / raw)
  To: linux-admin

here's what happens:
i trace from my box A to address B.
a router on the way NATs the destination into Z.
the next router (X) sends back a ttl exceeded message (ie from X to A, 
ttl exceeded), just as it should.
however, this ttl exceeded message is being natted! the router that NATs
is converting X into B??? why on earth is this? its definitely not my 
NAT rules.
i can only assume it has something do with statefulness. a bug or a 
feature?

in more detail:
my natting router:
Chain PREROUTING (policy ACCEPT)
DNAT       all  --  0.0.0.0/0            address B         to:address Z
Chain POSTROUTING (policy ACCEPT)
SNAT       all  --  address Z            0.0.0.0/0          to:address B

so trace shows:
traceroute to <address B> from <address A>, 30 hops max, 40 byte packets
  1  <the NAT router>  4 ms  4 ms  4 ms
  2  <address B>  4 ms  4 ms  4 ms
  3  * * *
  4 
in fact nr.2 is NOT from B, as B isnt even on. with tcpdump i can see 
that that mysterious number 2 packet is in fact
originally "from X to A" and after it passes my natting router it is 
converted into "from Z to A".

any help on how to get around this undesired behaviour is appreciated.

urgrue

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2003-01-16  9:55 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-01-16  9:55 peculiar netfilter behaviour urgrue

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).