Linux Netfilter discussions
 help / color / mirror / Atom feed
From: "Покотиленко Костик" <casper@meteor.dp.ua>
To: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
Cc: netfilter@lists.netfilter.org
Subject: Re: Catching un-DNAT'ed packets
Date: Tue, 26 Dec 2006 18:25:33 +0200	[thread overview]
Message-ID: <1167150333.4663.4.camel@localhost.localdomain> (raw)
In-Reply-To: <459102EC.50402@plouf.fr.eu.org>

В Вто, 26/12/2006 в 12:09 +0100, Pascal Hambourg пишет:

> > Where does the un-DNAT occurs and is there table/chain that is
> > processed after un-DNAT?
> 
> In 2.4 kernels, when DNAT occurs in the PREROUTING chain, un-DNAT occurs 
> at the same place as (and in place of) the POSTROUTING chain of the 
> 'nat' table, and there is no chain after it. In 2.4 kernels >= 2.4.19, 
> when DNAT occurs in the OUTPUT chain, un-DNAT occurs after the INPUT 
> chain of the 'filter' table, and there is no chain after it either. I 
> suppose it has not changed in 2.6 kernels.
> 
> > The problem I have is that replay packets got catched with real source
> > address, not the one the client has initially connected to. I was
> > catching replay packets in mangle/POSTROUTING.
> 
> The POSTROUTING chain of the 'mangle' table is just before the un-DNAT 
> place.

Thanks for the replay. You just confirmed my thoughts. It's really
strange to have a need solution for which is not invented yet :-/. I'm
not used to be one of the first in this area :)

So, this is subject for a wishlist...

-- 
Покотиленко Костик <casper@meteor.dp.ua>



  reply	other threads:[~2006-12-26 16:25 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2006-12-25 13:40 Catching un-DNAT'ed packets Покотиленко Костик
2006-12-26 11:09 ` Pascal Hambourg
2006-12-26 16:25   ` Покотиленко Костик [this message]
2007-01-26 11:21   ` iptables NEW TABLE request. WAS[Re: Catching un-DNAT'ed packets] Покотиленко Костик
2007-01-26 11:24     ` Jan Engelhardt
2007-01-26 12:33       ` Покотиленко Костик
2007-01-26 16:12         ` Jan Engelhardt
2007-01-26 16:27           ` Покотиленко Костик
2007-01-29 15:58     ` Покотиленко Костик
2007-01-30 10:46       ` Jan Engelhardt
2007-01-30 18:02         ` Jan Engelhardt
2007-01-31  9:14           ` Покотиленко Костик
2007-01-31 11:38             ` Pascal Hambourg
2007-01-31 13:01               ` Покотиленко Костик

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1167150333.4663.4.camel@localhost.localdomain \
    --to=casper@meteor.dp.ua \
    --cc=netfilter@lists.netfilter.org \
    --cc=pascal.mail@plouf.fr.eu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox