netfilter.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Alexander Y. Tiurin" <alexanderyt@gmail.com>
To: netfilter@vger.kernel.org
Subject: SNATing w/o SNAT rule
Date: Mon, 19 Nov 2012 17:34:10 +0400	[thread overview]
Message-ID: <50AA3552.6000609@gmail.com> (raw)

Hello.

host(10.11.110.67) ->gw (10.11.110.224) -> world(95.26.248.143)


From host:

$ ping -n world
PING world (95.26.248.143) 56(84) bytes of data.
64 bytes from 95.26.248.143: icmp_req=1 ttl=53 time=64.1 ms
64 bytes from 95.26.248.143: icmp_req=2 ttl=53 time=63.7 ms
64 bytes from 95.26.248.143: icmp_req=3 ttl=53 time=65.2 ms



From world:

# tcpdump -i ppp0 icmp
16:10:21.285647 IP 1.1.1.7 > 95.26.248.143: ICMP echo request, id 17110,
seq 1, length 64
16:10:21.285730 IP 95.26.248.143 > 1.1.1.7: ICMP echo reply, id 17110,
seq 1, length 64
16:10:22.286347 IP 1.1.1.7 > 95.26.248.143: ICMP echo request, id 17110,
seq 2, length 64
16:10:22.286402 IP 95.26.248.143 > 1.1.1.7: ICMP echo reply, id 17110,
seq 2, length 64
16:10:23.287056 IP 1.1.1.7 > 95.26.248.143: ICMP echo request, id 17110,
seq 3, length 64
16:10:23.287097 IP 95.26.248.143 > 1.1.1.7: ICMP echo reply, id 17110,
seq 3, length 64



But all SNAT gw  rules:

$ iptables -n -L -t nat -v --line-number | grep 1.1.1.7
15       0     0 DNAT       tcp  --  *      *       0.0.0.0/0           
1.1.1.7        tcp dpt:443 /* Port forwarding */ to:10.11.110.27
16       0     0 DNAT       tcp  --  *      *       0.0.0.0/0           
1.1.1.7        tcp dpt:6661 /* Port forwarding */ to:10.11.110.87
17       0     0 DNAT       tcp  --  *      *       0.0.0.0/0           
1.1.1.7        tcp dpt:3390 /* Port forwarding */ to:10.11.119.200
20       0     0 DNAT       tcp  --  *      *       0.0.0.0/0           
1.1.1.7        tcp dpt:3389 /* Port forwarding */ to:10.11.110.248
3      187 11220 SNAT       all  --  *      *       10.11.110.14        
0.0.0.0/0            to:1.1.1.7
4        0     0 SNAT       all  --  *      *       10.11.110.9         
0.0.0.0/0            to:1.1.1.7
5      864 78615 SNAT       all  --  *      *       10.11.110.111       
0.0.0.0/0            to:1.1.1.7
6        1    76 SNAT       all  --  *      *       10.11.110.26        
0.0.0.0/0            to:1.1.1.7
7        0     0 SNAT       all  --  *      *       10.11.110.170       
0.0.0.0/0            to:1.1.1.7
8        0     0 SNAT       all  --  *      *       10.11.110.6         
0.0.0.0/0            to:1.1.1.7
9        0     0 SNAT       all  --  *      *       10.11.110.107       
0.0.0.0/0            to:1.1.1.7
26       0     0 SNAT       all  --  *      *       10.11.110.57        
0.0.0.0/0            to:1.1.1.7
27       0     0 SNAT       all  --  *      *       10.11.110.87        
0.0.0.0/0            to:1.1.1.7
30       0     0 SNAT       all  --  *      *       10.11.110.248       
0.0.0.0/0            to:1.1.1.7
31       0     0 SNAT       all  --  *      *       10.11.119.200       
0.0.0.0/0            to:1.1.1.7
32       0     0 SNAT       all  --  *      *       10.11.110.27        
0.0.0.0/0            to:1.1.1.7
37      75  4940 SNAT       all  --  *      *       10.11.108.251       
0.0.0.0/0            to:1.1.1.7

This is strange, because a rule for host(10.11.110.67) isn't present.

And on gw:

$ iptables-save | grep -i masquerade
$

Why 10.11.110.67 change to 1.1.1.7?






                 reply	other threads:[~2012-11-19 13:34 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=50AA3552.6000609@gmail.com \
    --to=alexanderyt@gmail.com \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).