Re: final packet not natted, rfc1918 address sent to internet

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Jozsef Kadlecsik a écrit :
> On Wed, 24 Nov 2010, Dave Sparks wrote:
> 
>> I noticed a problem that happens on all our firewalls (various 2.6 and 
>> Shorewall version) where sometimes the final packet in a conversation 
>> will not be natted.  What happens is the src IP is not rewritten, and 
>> the rfc1918 src address is sent to the internet.
[...]
> I guess the packet in question has got INVALID state: those are not 
> NAT-ed (being INVALID, cannot be). So add a rule which drops INVALID 
> packets.

I agree. In a NAT setup, packets with the INVALID state should be
dropped because NAT relies on connection tracking.

The trace shows that the last packet is a FIN segment retransmitted
multiple times because it was not ACK'ed by the other side. It should
not be the last packet of the connection, the other side should send an
ACK segment. I guess that after a 60-second delay the connection
tracking entry expired and this is why the FIN packet got the INVALID
state. The root cause is the missing ACK.