From: Bernardo Innocenti <bernie@develer.com>
To: Cristian Grigoriu <cristian.grigoriu@provus.ro>
Cc: b.innocenti@develer.com, lkml <linux-kernel@vger.kernel.org>
Subject: Re: NAT failure with TCP, too
Date: Mon, 23 Oct 2006 01:41:34 +0200 [thread overview]
Message-ID: <453C01AE.7060103@develer.com> (raw)
In-Reply-To: <4538B314.2020309@provus.ro>
Cristian Grigoriu wrote:
> Hi,
>
> I can confirm the same bug you reported here
> http://www.ussg.iu.edu/hypermail/linux/kernel/0509.2/0279.html
> This time it happens with TCP connections originating from the same TCP
> port (1234) from multiple machines. The SNAT simply doesn't take place
> and the normal routing occurs.
>
> Kernel is Debian stock 2.6.18-1.
>
> Please let me know if you have find a workaround.
It turned out that the real thing that was triggering the bug
for me was unloading and reloading the ip_nat module without
also reloading ip_conntrack.
The connection tracking tuple would remain in the kernel, visible
in /proc/net/ip_conntrack, but no longer linked to the SNAT rule.
I'd consider this a bug, but very few users will ever be affected.
The workaround for me was to remove my hand-cracted iptables
rules from ppp's ip-up.local and move them to the distro-supplied
iptables firewall instead. The only downside is that I must now
hardcode the destination ip of the SNAT rule because it's too early
to read the interface address of ppp0.
--
// Bernardo Innocenti - Develer S.r.l., R&D dept.
\X/ http://www.develer.com/
next parent reply other threads:[~2006-10-22 23:41 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <4538B314.2020309@provus.ro>
2006-10-22 23:41 ` Bernardo Innocenti [this message]
2006-10-22 23:53 ` NAT failure with TCP, too H. Peter Anvin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=453C01AE.7060103@develer.com \
--to=bernie@develer.com \
--cc=b.innocenti@develer.com \
--cc=cristian.grigoriu@provus.ro \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox