Re: DNATing packets sent to the NATing box

[Jeffrey Laramie <JALaramie@Loudoun-Fairfax.com>]

On Sunday 14 December 2003 12:16, Antony Stone wrote:
> On Sunday 14 December 2003 4:55 pm, Jeffrey Laramie wrote:
> > On Sunday 14 December 2003 11:04, horape@tinuviel.compendium.com.ar wrote:
> > > The proxy has a udp socket bound to port 5000, and another udp socket
> > > bound to some other port, it reads from the first socket and does a
> > > sendto using the other socket (poll + read + write, no more)
> >
> > It looks like the proxy is grabbing the packets first and then dropping
> > them directly onto the INPUT chain. Try disabling the proxy and release
> > the bound ports then try it again. Once the packets reach PREROUTING you
> > can DNAT them to another port.
>
> I could ubnderstand the proxy code managing to grab the packet off the wire
> before netfilter (PREROUTING) sees it, but I don't see how it would then
> get seen by the INPUT chain - as far as I know, it's not possible for a
> packet to reach netfilter's INPUT chain without first going through the
> PREROUTING chain.   If a packet bypasses one of these, it will bypass both.

Well that's what I thought but I can't explain his results any other way. What 
are we missing here?

Jeff