Re: RP_FILTER runs too late

Rob Landley
2001-08-07T09:55:59Z

On Tuesday 07 August 2001 02:43, David Ford wrote:
> I finally figured out why my SNAT setup wasn't working. I had 1 in
> eth0/rp_filter and that was silently breaking it.
>
> This discussion follows the scripts located at website
> http://blue-labs.org/ , rc.networking and rc.firewalling. Both are live
> meaning you'll see any changes I make.
>
> Here's the scoop. I run a VPN from here to my colo server...but I don't
> want all my traffic going through the VPN. So I need to finagle a
> method of NAT. Now because the NAT code runs behind the routing code,
> packets are already heading the wrong direction when they get their
> headers changed. Because of that you need to tag them with a mark and
> implement routing rules based on that mark. As an aside note, all that
> could be avoided if SNAT would just be available in PREROUTING.
>
> Ok. Now that packets are flowing through the right interfaces, things
> look good but wait...the reply packets are vanishing without a trace.
>
> The culprit is the rp_filter on eth0. The packet comes in, gets the
> header rewritten then gets chomped by rp_filter. I'm not quite sure why
> because the src is still an external IP and the destination before and
> after is still an internal IP.
>
> Wouldn't the rp_filter be more effective if it came ahead of the nat
> code? As it is now, it's useless on that interface.
>
> David

I just put up some firewall rules as part of the Dynamic Virtual Private
Networking project on sourceforge at http://dvpn.sourceforge.net. It shows
both source and destination nat, port forwarding outside of a box, and a
couple other fun goodies. Not necessarily your kind of VPN, but maybe it'll
help...

I'm not sure what you're trying to do, but I got everything I tried to work...

Rob