From: Alexander Clouter <alex@digriz.org.uk>
To: linux-kernel@vger.kernel.org
Subject: Re: SNATed connections show as original ip in /proc/net/tcp
Date: Sun, 11 Jul 2010 15:30:25 +0100 [thread overview]
Message-ID: <151pg7-26g.ln1@chipmunk.wormnet.eu> (raw)
In-Reply-To: op.vfn83jvflgimzx@win7
Noah McNallie <n0ah@n0ah.org> wrote:
>
> just as the topic describes.
>
Probably better to post this to netdev?
> I'm currently doing SNAT to force some destination tcp ports to be routed
> through a specific route rather than the default route. To accomplish this
> I mark thoes packets with iptables, use 'ip' to specify marked packets via
> the specified route, and then use iptables to change their source address.
>
SNAT'ing locally sourced traffic? That's pretty nasty.
Look into using 'ip rule' and a second routing table.
http://lartc.org/howto/lartc.rpdb.html
You will still need use iptables/MARK to do L4 (tcp/udp/etc) policy
routing though, however now you can dump the ugly SNATing.
Cheers
--
Alexander Clouter
.sigmonster says: Where do your SOCKS go when you lose them in th' WASHER?
next prev parent reply other threads:[~2010-07-11 15:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-07-11 9:10 SNATed connections show as original ip in /proc/net/tcp Noah McNallie
2010-07-11 14:30 ` Alexander Clouter [this message]
2010-07-11 15:11 ` Noah McNallie
2010-07-11 17:08 ` Alexander Clouter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=151pg7-26g.ln1@chipmunk.wormnet.eu \
--to=alex@digriz.org.uk \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox