Re: stateless nat *please* tell me how I'm supposed to use it

[Erik Slagter <erik@slagter.name>]

[-- Attachment #1: Type: text/plain, Size: 1014 bytes --]

Hi everybody,

I am a little disappointed that nobody can or wants to tell me how
stateless nat is supposed to be used. As no other documentation exists
on this subject, this gives the impression this knowledge is a secret?

For people that run into the same problem, I can tell that I've found
the solution, with help from Rodrigo Partearroyo González. The key is
that packet munging on this level is only useful if performed before
routing and as the (normal) egress qdisc is called only just before the
handing the packet to the device, the stateless nat is performed by the
"ingress" qdisc and so the nat action / filter needs to be attached to
the, to be added, tc ingress qdisc. And then it works, e.g.

tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol ip prio 10 u32 match ip src
1.2.3.4 action nat egress 1.2.3.4/32 5.6.7.8

I guess the "pedit" and related actions work alike.

Now I am still wondering what the "tc action" syntax is for.

Erik Slagter.


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5110 bytes --]