From: "H. Peter Anvin" <hpa@zytor.com>
To: Bernardo Innocenti <bernie@develer.com>
Cc: Cristian Grigoriu <cristian.grigoriu@provus.ro>,
b.innocenti@develer.com, lkml <linux-kernel@vger.kernel.org>
Subject: Re: NAT failure with TCP, too
Date: Sun, 22 Oct 2006 16:53:20 -0700 [thread overview]
Message-ID: <453C0470.6090503@zytor.com> (raw)
In-Reply-To: <453C01AE.7060103@develer.com>
Bernardo Innocenti wrote:
>
>
> Cristian Grigoriu wrote:
>> Hi,
>>
>> I can confirm the same bug you reported here
>> http://www.ussg.iu.edu/hypermail/linux/kernel/0509.2/0279.html
>> This time it happens with TCP connections originating from the same
>> TCP port (1234) from multiple machines. The SNAT simply doesn't take
>> place and the normal routing occurs.
>>
>> Kernel is Debian stock 2.6.18-1.
>>
>> Please let me know if you have find a workaround.
>
> It turned out that the real thing that was triggering the bug
> for me was unloading and reloading the ip_nat module without
> also reloading ip_conntrack.
>
> The connection tracking tuple would remain in the kernel, visible
> in /proc/net/ip_conntrack, but no longer linked to the SNAT rule.
> I'd consider this a bug, but very few users will ever be affected.
>
> The workaround for me was to remove my hand-cracted iptables
> rules from ppp's ip-up.local and move them to the distro-supplied
> iptables firewall instead. The only downside is that I must now
> hardcode the destination ip of the SNAT rule because it's too early
> to read the interface address of ppp0.
>
You may want to use the MASQUERADE target instead of the SNAT target.
-hpa
prev parent reply other threads:[~2006-10-22 23:53 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <4538B314.2020309@provus.ro>
2006-10-22 23:41 ` NAT failure with TCP, too Bernardo Innocenti
2006-10-22 23:53 ` H. Peter Anvin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=453C0470.6090503@zytor.com \
--to=hpa@zytor.com \
--cc=b.innocenti@develer.com \
--cc=bernie@develer.com \
--cc=cristian.grigoriu@provus.ro \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox