From: Andrew Beverley <andy@andybev.com>
To: Jan Engelhardt <jengelh@medozas.de>
Cc: Ronald <ronald645@gmail.com>, netfilter@vger.kernel.org
Subject: Re: Redirecting ports with netfilter: unexpected varying results possibly correlated with NAT
Date: Sat, 29 Oct 2011 23:22:36 +0100 [thread overview]
Message-ID: <1319926956.2993.61.camel@steve-pc> (raw)
In-Reply-To: <alpine.LNX.2.01.1110292128120.32690@frira.zrqbmnf.qr>
On Sat, 2011-10-29 at 21:29 +0200, Jan Engelhardt wrote:
> On Saturday 2011-10-29 20:23, Andrew Beverley wrote:
> >> I can even add the following
> >> line to my server. (This is in the case I use port redirection. Then I
> >> use this line to make it an effective security enhancement):
> >>
> >> iptables -I PREROUTING -t raw -p udp --dport 500 -j DROP
> >
> >Yes, but the packets originating from the server will not pass through
> >the PREROUTING chain.
> >
> >> Besides, I designed my netfilter configuration to not differentiate
> >> between interfaces. I use the addrtype extension, works better.
> >
> >I like that, but remember that any packets leaving the server will only
> >traverse the OUTPUT and POSTROUTING chains.
>
> This is wrong information.
>
> Packets very well pass through PREROUTING even when they come from lo.
Sorry, I meant locally generated packets leaving the server, in which
case I assume that they do not go through POSTROUTING?
next prev parent reply other threads:[~2011-10-29 22:22 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-10-23 12:29 Redirecting ports with netfilter: unexpected varying results possibly correlated with NAT Ronald
2011-10-26 20:52 ` Ronald
2011-10-26 22:37 ` Andrew Beverley
2011-10-26 22:44 ` Andrew Beverley
2011-10-27 4:16 ` Ronald
2011-10-27 6:24 ` Andrew Beverley
2011-10-27 6:45 ` Ronald
2011-10-29 18:23 ` Andrew Beverley
2011-10-29 19:29 ` Jan Engelhardt
2011-10-29 22:22 ` Andrew Beverley [this message]
2011-10-29 22:39 ` Andrew Beverley
2011-10-29 20:10 ` Ronald
2011-10-29 22:59 ` Andrew Beverley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1319926956.2993.61.camel@steve-pc \
--to=andy@andybev.com \
--cc=jengelh@medozas.de \
--cc=netfilter@vger.kernel.org \
--cc=ronald645@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox