From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: Re-routing packets via netfilter (ip_rt_bug) Date: Wed, 27 Apr 2005 12:26:13 +0200 Message-ID: <426F68C5.4010109@trash.net> References: <426D0CB9.4060500@trash.net> <20050425213400.GB29288@gondor.apana.org.au> <426D8672.1030001@trash.net> <20050426003925.GA13650@gondor.apana.org.au> <426E3F67.8090006@trash.net> <20050426232857.GA18358@gondor.apana.org.au> <426EE350.1070902@trash.net> <20050427010730.GA18919@gondor.apana.org.au> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: netdev@oss.sgi.com, netfilter-devel@lists.netfilter.org, Yair@arx.com, linux-kernel@vger.kernel.org Return-path: To: Herbert Xu In-Reply-To: <20050427010730.GA18919@gondor.apana.org.au> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-devel-bounces@lists.netfilter.org Errors-To: netfilter-devel-bounces@lists.netfilter.org List-Id: netdev.vger.kernel.org Herbert Xu wrote: > Couldn't we feed the TCP RST packets with foreign sources through > the FORWARD table? We're lying to the routing system already by > telling it that the packet is forwarded. So I don't see anything > wrong with lying to netfilter as well :) Forwarded packets can't have any NAT manips in LOCAL_OUT, so it should work. I'm not sure about it though because it would be the only place where packets just appear in FORWARD, usually all packets enters through PRE_ROUTING or LOCAL_OUT. Regards Patrick