From: Philip Craig <philipc@snapgear.com>
To: Zoilo <zoilo@xs4all.nl>
Cc: netfilter@lists.netfilter.org
Subject: Re: NAT PREROUTING chain ignored on returning traffic ??
Date: Mon, 01 Sep 2003 17:46:43 +1000 [thread overview]
Message-ID: <3F52F963.70202@snapgear.com> (raw)
In-Reply-To: <3F4FA204.6010605@xs4all.nl>
Zoilo wrote:
> So why does a returning packet not travel through the NAT PREROUTING
> chain, whereas a new incoming ping does travel through the NAT
> PREROUTING chain? Both packets have exactly the same destination, huh?
The nat table is used to set up the nat mappings for a connection.
Since the nat mappings do not change throughout the life of the
connection, this is only done for the first packet in the connection.
Therefore, the nat table will only see packets that have a state
of NEW or RELATED.
For further evidence of this, notice that the outgoing packet in II)
goes through the nat OUTPUT and POSTROUTING chains, but the outgoing
packet in I) does not.
--
Philip Craig - philipc@snapgear.com - http://www.SnapGear.com
SnapGear - Custom Embedded Solutions and Security Appliances
prev parent reply other threads:[~2003-09-01 7:46 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-08-29 18:57 NAT PREROUTING chain ignored on returning traffic ?? Zoilo
2003-08-31 5:31 ` Jim Carter
2003-09-01 13:58 ` Zoilo
2003-09-01 7:46 ` Philip Craig [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3F52F963.70202@snapgear.com \
--to=philipc@snapgear.com \
--cc=netfilter@lists.netfilter.org \
--cc=zoilo@xs4all.nl \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox