More on conntrack + NAT + mangle/nat tables

["Lluís Batlle" <viriketo@gmail.com>]

I already understood that a packet enters chains in the 'nat' table
only if it is the _first_ packet of a connection. In that case, we may
do SNAT in the POSTROUTING chain of the 'nat' table.
So, the packets arrive to the POSTROUTING chain of the 'mangle' table
with the source IP address changed (if it's said by the rules of the
'nat' table).

BUT, for the rest of the packets (not the first ones) of a connection,
packets enter the POSTROUTING chain of the 'mangle' table _without_ a
changed source IP address. Is this the expected behaviour of
netfilter/conntrack?

To me, it's quite strange.

- I'm learning about the whole netfilter/policy router these days :)
So I write a lot about that, which sounds strange to me. I hope I'm
not annoying to the list.

Thanks a lot.

- Lluís