* icmp echo reply && FORWARD chain
@ 2004-05-02 14:24 Jee J.Z.
2004-05-02 14:46 ` Antony Stone
0 siblings, 1 reply; 6+ messages in thread
From: Jee J.Z. @ 2004-05-02 14:24 UTC (permalink / raw)
To: netfilter
Hi all,
My rules on a gateway linux box (PC2) are set as follows:
Internet(PC1 and so on)-----------(eth0)-PC2-(eth1)-------------Internal
networks(PC3 and so on...)
iptables -F
iptables -F -t nat
iptables -I FORWARD -j QUEUE
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2
ICMP echo request packets from PC1 or PC3 to PC2 can be caught by the
FORWARD chain queuing to userspace, however, ICMP echo reply (in response to
ping request from PC2) packets from PC1 or PC3 to PC2 will be ignored by the
FORWARD chain. Is this a reasonable phenomenon? Could anyone tell me the
reasons? Thanks a lot in advance!
Cheers,
Jee
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: icmp echo reply && FORWARD chain
2004-05-02 14:24 icmp echo reply && FORWARD chain Jee J.Z.
@ 2004-05-02 14:46 ` Antony Stone
2004-05-02 15:29 ` Jee J.Z.
0 siblings, 1 reply; 6+ messages in thread
From: Antony Stone @ 2004-05-02 14:46 UTC (permalink / raw)
To: netfilter
On Sunday 02 May 2004 3:24 pm, Jee J.Z. wrote:
> Hi all,
>
> My rules on a gateway linux box (PC2) are set as follows:
>
> Internet(PC1 and so on)-----------(eth0)-PC2-(eth1)-------------Internal
> networks(PC3 and so on...)
>
> iptables -F
> iptables -F -t nat
> iptables -I FORWARD -j QUEUE
> iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2
That is a weird-looking rule. Where does IP 192.168.0.2 exist on the above
diagram?
> ICMP echo request packets from PC1 or PC3 to PC2 can be caught by the
> FORWARD chain queuing to userspace, however, ICMP echo reply (in response
> to ping request from PC2) packets from PC1 or PC3 to PC2 will be ignored by
> the FORWARD chain. Is this a reasonable phenomenon? Could anyone tell me
> the reasons? Thanks a lot in advance!
>
> Cheers,
> Jee
--
Ramdisk is not an installation procedure.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: icmp echo reply && FORWARD chain
2004-05-02 14:46 ` Antony Stone
@ 2004-05-02 15:29 ` Jee J.Z.
2004-05-02 15:42 ` Antony Stone
0 siblings, 1 reply; 6+ messages in thread
From: Jee J.Z. @ 2004-05-02 15:29 UTC (permalink / raw)
To: netfilter
Hi Antony,
Sorry for the confusion.
> On Sunday 02 May 2004 3:24 pm, Jee J.Z. wrote:
>
> > Hi all,
> >
> > My rules on a gateway linux box (PC2) are set as follows:
> >
> > Internet(PC1 and so
on)-----------(eth0:global_ip)-PC2-(eth1:192.168.0.1)-------------Internal
> > networks(PC3(192.168.0.2) and so on...)
> >
> > iptables -F
> > iptables -F -t nat
> > iptables -I FORWARD -j QUEUE
> > iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> > iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2
>
> That is a weird-looking rule. Where does IP 192.168.0.2 exist on the
above
> diagram?
It's the internal IP of PC3. I modified the diagram a little bit. Thank you.
Jee
> > ICMP echo request packets from PC1 or PC3 to PC2 can be caught by the
> > FORWARD chain queuing to userspace, however, ICMP echo reply (in
response
> > to ping request from PC2) packets from PC1 or PC3 to PC2 will be ignored
by
> > the FORWARD chain. Is this a reasonable phenomenon? Could anyone tell me
> > the reasons? Thanks a lot in advance!
> >
> > Cheers,
> > Jee
>
> --
> Ramdisk is not an installation procedure.
>
> Please reply to the
list;
> please don't CC
me.
>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: icmp echo reply && FORWARD chain
2004-05-02 15:29 ` Jee J.Z.
@ 2004-05-02 15:42 ` Antony Stone
2004-05-02 22:43 ` Jee J.Z.
0 siblings, 1 reply; 6+ messages in thread
From: Antony Stone @ 2004-05-02 15:42 UTC (permalink / raw)
To: netfilter
On Sunday 02 May 2004 4:29 pm, Jee J.Z. wrote:
> Hi Antony,
>
> Sorry for the confusion.
>
> > > My rules on a gateway linux box (PC2) are set as follows:
> > >
> > > Internet (PC1 and so on)
> > > |
> > > |
> > > (eth0:global_ip)
> > > PC2
> > > (eth1:192.168.0.1)
> > > |
> > > |
> > > Internal networks (PC3 (192.168.0.2) and so on...)
> > >
> > > iptables -F
> > > iptables -F -t nat
> > > iptables -I FORWARD -j QUEUE
> > > iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> > > iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2
> >
> > That is a weird-looking rule. Where does IP 192.168.0.2 exist on the
> > above diagram?
>
> It's the internal IP of PC3. I modified the diagram a little bit. Thank you.
I modified it a bit too, so we don't have problems with line-wrap.
So, what you're saying is that any packet coming in on eth1, addressed to
anywhere at all, gets DNATted, and sent straight back out eth1 again, now
addressed to PC3. Hm.
Why?
Antony.
PS: I'm not sure if the sig below (which gets selected at random by my mail
client) is appropriate here, however I can't see it doing any harm to remind
people :)
--
90% of networking problems are routing problems.
9 of the remaining 10% are routing problems in the other direction.
The remaining 1% might be something else, but check the routing anyway.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: icmp echo reply && FORWARD chain
2004-05-02 15:42 ` Antony Stone
@ 2004-05-02 22:43 ` Jee J.Z.
2004-05-02 23:03 ` Antony Stone
0 siblings, 1 reply; 6+ messages in thread
From: Jee J.Z. @ 2004-05-02 22:43 UTC (permalink / raw)
To: netfilter
Hi Antony,
Oh, dear! I am making a lot ot mistakes. The rules are as follows:
iptables -F
iptables -F -t nat
iptables -I FORWARD -j QUEUE
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 192.168.0.2
The problem is that it seems icmp request destined to PC2 can be caught by
the FORWARD chain, however, the icmp reply destined to PC2 is ignored by the
FORWARD chain.
Sorry again,
Jee
PS, however, you remind me a kind of setup to make traffic bouncing back to
the same subnet.:p
> On Sunday 02 May 2004 4:29 pm, Jee J.Z. wrote:
>
> > Hi Antony,
> >
> > Sorry for the confusion.
> >
> > > > My rules on a gateway linux box (PC2) are set as follows:
> > > >
> > > > Internet (PC1 and so on)
> > > > |
> > > > |
> > > > (eth0:global_ip)
> > > > PC2
> > > > (eth1:192.168.0.1)
> > > > |
> > > > |
> > > > Internal networks (PC3 (192.168.0.2) and so on...)
> > > >
> > > > iptables -F
> > > > iptables -F -t nat
> > > > iptables -I FORWARD -j QUEUE
> > > > iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> > > > iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2
> > >
> > > That is a weird-looking rule. Where does IP 192.168.0.2 exist on the
> > > above diagram?
> >
> > It's the internal IP of PC3. I modified the diagram a little bit. Thank
you.
>
> I modified it a bit too, so we don't have problems with line-wrap.
>
> So, what you're saying is that any packet coming in on eth1, addressed to
> anywhere at all, gets DNATted, and sent straight back out eth1 again, now
> addressed to PC3. Hm.
>
> Why?
>
> Antony.
>
> PS: I'm not sure if the sig below (which gets selected at random by my
mail
> client) is appropriate here, however I can't see it doing any harm to
remind
> people :)
>
> --
> 90% of networking problems are routing problems.
> 9 of the remaining 10% are routing problems in the other direction.
> The remaining 1% might be something else, but check the routing anyway.
>
> Please reply to the
list;
> please don't CC
me.
>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: icmp echo reply && FORWARD chain
2004-05-02 22:43 ` Jee J.Z.
@ 2004-05-02 23:03 ` Antony Stone
0 siblings, 0 replies; 6+ messages in thread
From: Antony Stone @ 2004-05-02 23:03 UTC (permalink / raw)
To: netfilter
On Sunday 02 May 2004 11:43 pm, Jee J.Z. wrote:
> Hi Antony,
>
> Oh, dear! I am making a lot ot mistakes. The rules are as follows:
>
> iptables -F
> iptables -F -t nat
> iptables -I FORWARD -j QUEUE
> iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 192.168.0.2
>
> The problem is that it seems icmp request destined to PC2 can be caught by
> the FORWARD chain, however, the icmp reply destined to PC2 is ignored by
> the FORWARD chain.
This may seem like a strange suggestion (however, it seems you are trying to
do something quite strange, I think...), but try putting the QUEUE target
into the mangle table instead of the filter table (mangle tables generally
see more packets than filter tables, because nothing 'magic' happens in the
background, causing packets to bypass them, which is the case with filter
tables and nat tables):
iptables -A FORWARD -t mangle -j QUEUE
Regards,
Antony.
--
The idea that Bill Gates appeared like a knight in shining armour to lead all
customers out of a mire of technological chaos neatly ignores the fact that
it was he who, by peddling second-rate technology, led them into it in the
first place.
- Douglas Adams in The Guardian, 25th August 1995
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2004-05-02 23:03 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-05-02 14:24 icmp echo reply && FORWARD chain Jee J.Z.
2004-05-02 14:46 ` Antony Stone
2004-05-02 15:29 ` Jee J.Z.
2004-05-02 15:42 ` Antony Stone
2004-05-02 22:43 ` Jee J.Z.
2004-05-02 23:03 ` Antony Stone
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox