Re: NAT tables and FILTER tables

[Aseem Rastogi <aseem@india.tejasnetworks.com>]

thanks joerg. this infact was the second line of thought that i had in 
mind. i just posted the first one :-).

Jörg Harmuth wrote:

> Aseem Rastogi wrote:
>
>> in continuation:
>>
>> i am actually trying to understand how nat and default filter table 
>> work together. my understanding is this:
>>
>> when a packet is encountered it is either:
>>
>> 1. a new connection creation request packet.
>>
>> 2. a packet associated with a connection that has been mangled by NAT 
>> earlier.
>>
>> 3. a packet assiciated with a connection that has not been mangled by 
>> NAT earlier.
>
>
> Not really. Each packet is one of:
>
> -> NEW packet with SYN set
> -> NEW packet without SYN set
> -> Part of a connection which has seen at least the SYN packet
>
> Basically, a NEW packet means, that there is no entry in the conntrack 
> table.
>
>> Each case goes like this:
>>
>> Case 1: NAT table is considerd. Packet passes through PREROUTING 
>> chain, routing decision and then POSTROUTING chain.
>
>
> No. Then filter/INPUT or filter/FORWARD - always.
>
>> Case 1a -- If either of them modified the packet, this packet and all 
>> subsequent packets of this connection DO NOT PASS THROUGH FILTER 
>> TABLE CHAINS.
>>
>> Case 1b -- None of NAT tables modifies packet. It passes through 
>> FILTER table chains as usual.
>
>
> No. See above.
>
>> Case 2: This packet follows the fate of its earlier packets. 
>> (PREROUTING AND POSTROUTING NAT table chains BUT NO FILTER table chains)
>>
>> Case 3. Passes through FILTER TABLE chains.
>>
>> is this correct??
>
>
> No. It is almost vice-versa. Only NEW packet pass nat table, but all 
> packets pass filter table.
>
> If you apply NAT to the first packet, these subsequent packet will be 
> NATed automagically, so - in your words - they follow the fate of 
> their earlier packet concerning NAT.
>
> HTH and have a nice time,
>
> Joerg
>
> PS: May I recommend Oskar Andreasson's excellent iptables tutorial at 
> http://iptables-tutorial.frozentux.net/chunkyhtml/index.html ?
>
>> Aseem Rastogi wrote:
>>
>>> Hi,
>>>
>>> I have a small query.
>>>
>>> I have read that whenever a packet requesting a connection is 
>>> encountered, NAT table is used. My question is : Does it mean that 
>>> for new connection request packets ONLY NAT table is considered and 
>>> not default FILTER table?
>>
>
>
>


-- 
The end is always good. If it's not good, it's not the end.