From mboxrd@z Thu Jan 1 00:00:00 1970 From: horape@tinuviel.compendium.com.ar Subject: Re: DNATing packets sent to the NATing box Date: Sun, 14 Dec 2003 13:04:16 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20031214160416.GA17220@tinuviel.compendium.com.ar> References: <20031214135211.GA11695@tinuviel.compendium.com.ar> <200312140919.04832.JALaramie@Loudoun-Fairfax.com> <20031214152613.GA14170@tinuviel.compendium.com.ar> <200312141051.55776.JALaramie@Loudoun-Fairfax.com> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-Disposition: inline In-Reply-To: <200312141051.55776.JALaramie@Loudoun-Fairfax.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: Jeffrey Laramie Cc: netfilter@lists.netfilter.org > > I do: > > iptables -t nat -A PREROUTING -p udp -j LOG --log-prefix "PREROUTING: " > > iptables -t filter -A INPUT -p udp -j LOG --log-prefix "INPUT: " > > (I'm logged in that box via ssh, so I prefer not to do -p all) > > There are no more rules than these ones. > > In the log I see the INPUT ones but not the PREROUTING (only see on > > PREROUTING packets to port 137, maybe some worm...) > That's very strange. You said in your first post that you had a udp proxy= =20 > running. Is it on this box? I'm not sure at what level a proxy hooks into= the=20 > box, but I know that some programs read the data stream before netfilter = sees=20 > it. If the proxy is in front of netfilter then netfilter would never see= =20 > those packets. The port 137 packets are prolly just internet garbage. The proxy has a udp socket bound to port 5000, and another udp socket bound= to some other port, it reads from the first socket and does a sendto using the other socket (poll + read + write, no more) > > > You should see tons output in /var/log/messages including the packets > > > you're looking for. If the packets aren't there, then they aren't mak= ing > > > it to the box. > > But the packets got to the INPUT rule, that should be after PREROUTING.= And > > got to my socket. > Can you show these log entries? I don't even know how that could happen. = Maybe=20 > someone else has some ideas. Dec 14 15:57:22 ivrip kernel: INPUT: IN=3Deth0 OUT=3D MAC=3D00:0a:e6:fa:c6:= 09:00:09:12:2b:5e:fd:08:00 SRC =3D200.61.169.146 DST=3D200.68.94.100 LEN=3D60 TOS=3D0x00 PREC=3D0xA0 TTL= =3D251 ID=3D17815 PROTO=3DUDP SPT=3D17314 DP T=3D5000 LEN=3D40 Dec 14 15:57:23 ivrip last message repeated 47 times Dec 14 15:57:23 ivrip kernel: INPUT: IN=3Deth0 OUT=3D MAC=3D00:0a:e6:fa:c6:= 09:00:09:12:2b:5e:fd:08:00 SRC =3D200.61.169.146 DST=3D200.68.94.100 LEN=3D41 TOS=3D0x00 PREC=3D0xA0 TTL= =3D251 ID=3D17855 PROTO=3DUDP SPT=3D17314 DP T=3D5000 LEN=3D21 Lots of those. Only very sporadic, non related PREROUTING ones, like: Dec 14 15:57:58 ivrip kernel: PREROUTING: IN=3Deth0 OUT=3D MAC=3D00:0a:e6:f= a:c6:09:00:09:12:2b:5e:fd:08:0 0 SRC=3D217.126.141.13 DST=3D200.68.94.100 LEN=3D78 TOS=3D0x00 PREC=3D0x00 = TTL=3D108 ID=3D31313 PROTO=3DUDP SPT=3D566 66 DPT=3D137 LEN=3D58 iptables-save says: # Generated by iptables-save v1.2.9 on Sun Dec 14 15:59:05 2003 *nat :PREROUTING ACCEPT [1474:107026] :POSTROUTING ACCEPT [19:2376] :OUTPUT ACCEPT [19:2376] -A PREROUTING -p udp -j LOG --log-prefix "PREROUTING: " COMMIT # Completed on Sun Dec 14 15:59:05 2003 # Generated by iptables-save v1.2.9 on Sun Dec 14 15:59:05 2003 *filter :INPUT ACCEPT [28639:3847013] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [26167:3457193] -A INPUT -p udp -j LOG --log-prefix "INPUT: " COMMIT # Completed on Sun Dec 14 15:59:05 2003 (Note that filter INPUT saw 28639 packets and PREROUTING just 1474 since la= st boot) > Jeff Saludos, HoraPe --- Horacio J. Pe=F1a horape@compendium.com.ar horape@uninet.edu