Source NAT in POSTROUTING chain for locally generated packets

[Michael Schwartzkopff <ms@sys4.de>]

[-- Attachment #1: Type: text/plain, Size: 1363 bytes --]

Hi,

For some special reasons I want to alter the IP address of outgoing packets 
that are generated locally to a secondary IP address on my machine. For a test 
I use the udp/echo service. Without any rules a tcpdump looks like this:

192.168.56.101 is the primary address of the echo server and 192.168.56.16 is 
the secondary address of the interface.

08:24:04.063987 IP 192.168.56.1.48462 > 192.168.56.16.echo: UDP, length 6
08:24:04.064522 IP 192.168.56.101.echo > 192.168.56.1.48462: UDP, length 6

So I add the iptables rule:

iptables -t nat -I POSTROUTING -p udp -s 192.168.56.101 --sport 7 \
  -j SNAT --to-source 192.168.56.16

now tcpdump shows that no answer packet is sent out any more:

08:24:16.851095 IP 192.168.56.1.55362 > 192.168.56.16.echo: UDP, length 6


With iptables -t nat -L POSTROUTING I can see that the rule is hit since the 
counter increases. Also a iptables TRACE shows me that the rule is hit. No 
filter appears in the TRACE log.

Any ideas where the packet vanished?


Mit freundlichen Grüßen,

Michael Schwartzkopff

-- 
[*] sys4 AG

http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044
Franziskanerstraße 15, 81669 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 230 bytes --]