OUTPUT: nat after filter (2nd nat). Please help :(

OUTPUT: nat after filter (2nd nat). Please help :(

[krzf83@gmail.com]

According to graph at wikipedia
(http://imageshack.us/scaled/thumb/29/iptablesb.png) in OUTPUT nat
table is processed before AND after filter (2 times). I want to
utilize this second time:

iptables -t filter -A OUTPUT -d 1.2.3.4 -j DROP
iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner abc -j DNAT --to
127.0.0.1:121

Does not work because nat is executed befure filter.

iptables -t filter -A OUTPUT -d 1.2.3.4 -J DROP
iptables -t filter -A OUTPUT -m owner --uid-owner abc -j CONNMARK
--set-mark 0x1234
iptables -t nat -A OUTPUT -p tcp -m connmark --mark 0x1234 -j DNAT
--to 127.0.0.1:121

I think that should work. It does not. What am I missing? Please help :(

Re: OUTPUT: nat after filter (2nd nat). Please help :(

[Vigneswaran R]

On 05/14/2013 10:05 AM, krzf83@gmail.com wrote:
> According to graph at wikipedia
> (http://imageshack.us/scaled/thumb/29/iptablesb.png) in OUTPUT nat
> table is processed before AND after filter (2 times). I want to
> utilize this second time:
>
> iptables -t filter -A OUTPUT -d 1.2.3.4 -j DROP
> iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner abc -j DNAT --to
> 127.0.0.1:121
>
> Does not work because nat is executed befure filter.
>
> iptables -t filter -A OUTPUT -d 1.2.3.4 -J DROP
> iptables -t filter -A OUTPUT -m owner --uid-owner abc -j CONNMARK
> --set-mark 0x1234
> iptables -t nat -A OUTPUT -p tcp -m connmark --mark 0x1234 -j DNAT
> --to 127.0.0.1:121
>
> I think that should work. It does not. What am I missing? Please help :(

It seems, the two nat tables you are talking about are from different 
chains (OUTPUT, POSTROUTING). The order of packet flow between these 
tables will be like the following,

     OUTPUT nat --> OUTPUT filter --> POSTROUTING nat

So, if you want to filter the packets before nat you can do the following,

iptables -t filter -A OUTPUT -d 1.2.3.4 -J DROP
iptables -t nat -A POSTROUTING -p tcp -m owner --uid-owner abc -j DNAT --to
127.0.0.1:121

I found the following simplified iptables diagram useful for beginners.
<http://pritambaral.com/wp-content/uploads/2012/05/iptables.png>


Regards,
Vignesh

Re: OUTPUT: nat after filter (2nd nat). Please help :(

[Vigneswaran R]

On 05/14/2013 11:27 AM, krzf83@gmail.com wrote:
> Unfortunetly postrouting has not DNAT (only SNAT).

Oops.. I missed that.

> I figured only option is to rewrite all filters with conntrack and
> --ctorigdst --ctorigdstport, but contrack has to iprange. Only other
> option is to put filter rules in raw or mangle table. Both require
> huge rewrite of filter rules and thats only because iptables can't
> filter before DNAT :/ weird.

I think, if you give more details about your setup, people can help.


Regards,
Vignesh