Re: Why would certain packets not reach nat PREROUTING chain?

[Adam Rosi-Kessel <adam@rosi-kessel.org>]

[-- Attachment #1: Type: text/plain, Size: 1332 bytes --]

On Sun, Dec 18, 2005 at 032:42:43M -0500, Leonardo Rodrigues Magalhes wrote:
>     Adam, have you tried adding a properly PREROUTING rule for this 
> specific traffic ? It would be like
> iptables -t nat -A PREROUTING -p udp -d EXTERNAL_IP_OF_NAT_BOT --dport 
> 500 -j DNAT --to LOCAL_CLIENT

I have tried that--same result. In fact, I've tried creating a "tunnel"
between the internal and external client by leaving out the port
limitation, i.e.:

iptables -t nat -A PREROUTING -s SERVER_IP -j DNAT --to LOCAL_CLIENT

None of these have any effect because the packets never reach the nat
PREROUTING chain. If I put a LOG rule at the start of nat PREROUTING, I
don't see the inbound packets from the server on the Internet. (I do see
those packets in the mangle PREROUTING though).

>     Other test I would suggest ....... have you tried some other UDP 
> traffic, just like DNS and see if it works ? Have you tried some TCP 
> traffic and see if it works fine ?

Everything else seems to work fine. I have another internal box to which
certain ssh connections from the Internet go, and that's fine. I'm not
sure exactly how I'd test other UDP traffic... Certainly UDP traffic that
is FORWARDed through the NAT box (e.g., RealPlayer streams) seems fine.
-- 
Adam Rosi-Kessel
http://adam.rosi-kessel.org

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]