From: "Alexander Y. Tiurin" <alexanderyt@gmail.com>
To: netfilter@vger.kernel.org
Subject: SNATing w/o SNAT rule
Date: Mon, 19 Nov 2012 17:34:10 +0400 [thread overview]
Message-ID: <50AA3552.6000609@gmail.com> (raw)
Hello.
host(10.11.110.67) ->gw (10.11.110.224) -> world(95.26.248.143)
From host:
$ ping -n world
PING world (95.26.248.143) 56(84) bytes of data.
64 bytes from 95.26.248.143: icmp_req=1 ttl=53 time=64.1 ms
64 bytes from 95.26.248.143: icmp_req=2 ttl=53 time=63.7 ms
64 bytes from 95.26.248.143: icmp_req=3 ttl=53 time=65.2 ms
From world:
# tcpdump -i ppp0 icmp
16:10:21.285647 IP 1.1.1.7 > 95.26.248.143: ICMP echo request, id 17110,
seq 1, length 64
16:10:21.285730 IP 95.26.248.143 > 1.1.1.7: ICMP echo reply, id 17110,
seq 1, length 64
16:10:22.286347 IP 1.1.1.7 > 95.26.248.143: ICMP echo request, id 17110,
seq 2, length 64
16:10:22.286402 IP 95.26.248.143 > 1.1.1.7: ICMP echo reply, id 17110,
seq 2, length 64
16:10:23.287056 IP 1.1.1.7 > 95.26.248.143: ICMP echo request, id 17110,
seq 3, length 64
16:10:23.287097 IP 95.26.248.143 > 1.1.1.7: ICMP echo reply, id 17110,
seq 3, length 64
But all SNAT gw rules:
$ iptables -n -L -t nat -v --line-number | grep 1.1.1.7
15 0 0 DNAT tcp -- * * 0.0.0.0/0
1.1.1.7 tcp dpt:443 /* Port forwarding */ to:10.11.110.27
16 0 0 DNAT tcp -- * * 0.0.0.0/0
1.1.1.7 tcp dpt:6661 /* Port forwarding */ to:10.11.110.87
17 0 0 DNAT tcp -- * * 0.0.0.0/0
1.1.1.7 tcp dpt:3390 /* Port forwarding */ to:10.11.119.200
20 0 0 DNAT tcp -- * * 0.0.0.0/0
1.1.1.7 tcp dpt:3389 /* Port forwarding */ to:10.11.110.248
3 187 11220 SNAT all -- * * 10.11.110.14
0.0.0.0/0 to:1.1.1.7
4 0 0 SNAT all -- * * 10.11.110.9
0.0.0.0/0 to:1.1.1.7
5 864 78615 SNAT all -- * * 10.11.110.111
0.0.0.0/0 to:1.1.1.7
6 1 76 SNAT all -- * * 10.11.110.26
0.0.0.0/0 to:1.1.1.7
7 0 0 SNAT all -- * * 10.11.110.170
0.0.0.0/0 to:1.1.1.7
8 0 0 SNAT all -- * * 10.11.110.6
0.0.0.0/0 to:1.1.1.7
9 0 0 SNAT all -- * * 10.11.110.107
0.0.0.0/0 to:1.1.1.7
26 0 0 SNAT all -- * * 10.11.110.57
0.0.0.0/0 to:1.1.1.7
27 0 0 SNAT all -- * * 10.11.110.87
0.0.0.0/0 to:1.1.1.7
30 0 0 SNAT all -- * * 10.11.110.248
0.0.0.0/0 to:1.1.1.7
31 0 0 SNAT all -- * * 10.11.119.200
0.0.0.0/0 to:1.1.1.7
32 0 0 SNAT all -- * * 10.11.110.27
0.0.0.0/0 to:1.1.1.7
37 75 4940 SNAT all -- * * 10.11.108.251
0.0.0.0/0 to:1.1.1.7
This is strange, because a rule for host(10.11.110.67) isn't present.
And on gw:
$ iptables-save | grep -i masquerade
$
Why 10.11.110.67 change to 1.1.1.7?
reply other threads:[~2012-11-19 13:34 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50AA3552.6000609@gmail.com \
--to=alexanderyt@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).