Re: cbq.init and iptables NAT routing

[Cedric Blancher <blancher@cartel-securite.fr>]

I checked the code, and discovered I was wrong. Shaping is done _after_
Netfilter, i.e. after POSTROUTING chain.

I just tried this :

RULE=192.168.10.1/32

I ping 192.168.10.1 and stats are growing, so it matches.
Then, I'll DNAT in OUTPUT 192.168.10.1 to 192.168.10.12

iptables -t nat -A OUTPUT -d 192.168.10.1 -j DNAT --to 192.168.10.12

It does not match anymore => DNAT is done _before_ shaping.

No I flush

iptables -t nat -F

then set

RULE=192.168.10.11/32,

I ping 192.168.10.1, and counters are growing. It matches. Then I set
SNAT :

iptables -t nat -A POSTROUTING -d 192.168.10.1 -j SNAT --to 192.168.10.2
ip addr add 192.168.10.2 dev eth0

So I use 192.168.10.2 to emit py pings. And my class is no more reached
=> SNAT is done _before_ shaping also...

If I set :

RULE=192.168.10.2/32,

Class is reached again. So I was wrong... Sorry.

To answer your message :

Le jeu 03/10/2002 à 22:15, Aaron Clausen a écrit :
> iptables -t nat -A PREROUTING -i eth0 -d 64.251.69.2 -j DNAT --to 10.102.106.2

eth0 : RULE=64.251.69.2,
eth1 : RULE=10.102.106.2

> iptables -t nat -A POSTROUTING -o eth0 -s 10.102.106.2 -j SNAT --to 64.251.69.2

eth0 : RULE=64.251.69.2,
eth1 : RULE=10.102.106.2

[...]

> iptables -t nat -A POSTROUTING -o eth0 -s 10.101.104.0/21 -j MASQUERADE

eth0 : RULE=<eth0_IP>,
eth1 : RULE=10.101.104.0/21

Hope this will help you at last, and sorry again for the mistake. Going
to bed now, seems to be high time ;)

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE