Re: randomly SNATed devices after reboot

[Pascal Hambourg <pascal@plouf.fr.eu.org>]

Hello,

Vigneswaran R a écrit :
> On 05/15/2014 07:12 PM, Ethy H. Brito wrote:
>> Hi All
>>
>> I have this setup in which there are lots of static IPs "SNATed" IP-Phones
>> behind a Linux machine. A very simply NAT machine. Just one SNAT rule for the
>> phones' network.
>>
>> At every Linux machine reboot, some of those phones, randomly, simply does not
>> register at some outside-nat SIP server.
>>
>> Investigating with tcpdump I can see, at the external interface, "not snated"
>> packets from those not registered phones. Packets from the other phones are
>> correctly "snatted".
> 
> May be, some phones are trying to register via ESTABLISHED connections 
> which not getting SNATed. So, the registration fails.

Not ESTABLISHED (that would require return traffic, but existing (NEW).

If a phone sends a SIP packet before the SNAT rule is active, then the
whole SIP flow, including further packets, will not be SNATed until the
related conntrack entry expires. Expiration never happens if the sending
period is shorter than the UDP conntrack expiration delay.

If you don't want this to happen, just DROP all FORWARDed traffic until
the SNAT rule is active.