From: Bruno Meirelles <bmeirelles@gmail.com>
To: netfilter@vger.kernel.org
Subject: Rule does not work. This is configuration error or bug?
Date: Fri, 23 Sep 2022 19:07:05 -0300 [thread overview]
Message-ID: <88178cba-fbcf-70d0-bf11-380c4260d0cc@gmail.com> (raw)
Hi friends,
I have a dns cache on my server listening on port 53 tcp/udp on dual stack.
I'm trying to use the following rule to capture traffic and redirect to
my server:
nft add rule inet nat PREROUTING iifname "$LAN" meta l4proto {tcp, udp}
th dport 53 counter redirect to :53 comment Redirect-DNS
In ipv4 traffic, the rule works perfectly. In ipv6 traffic I do not
receive a response.
in the rule counter, the incoming packet appears:
table inet nat {
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
iifname "br0" meta l4proto { tcp, udp } th dport 53
counter packets 5 bytes 466 redirect to :53 comment "Redirect-DNS"
on nf_conntrack it appears unreplied:
cat /proc/net/nf_conntrack | grep dport=53
ipv6 10 udp 17 19 src=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513
dst=fd00:ffff:fffe:0100:0000:0000:0000:0001 sport=54959 dport=53
[UNREPLIED] src=2804:014d:5ca0:82f8:0000:0000:0000:0001
dst=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 sport=53 dport=54959 mark=0
zone=0 use=2
ipv6 10 udp 17 18 src=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513
dst=fd00:ffff:fffe:0100:0000:0000:0000:0001 sport=57101 dport=53
[UNREPLIED] src=2804:014d:5ca0:82f8:0000:0000:0000:0001
dst=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 sport=53 dport=57101 mark=0
zone=0 use=2
ipv6 10 udp 17 19 src=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513
dst=fd00:ffff:fffe:0100:0000:0000:0000:0001 sport=49518 dport=53
[UNREPLIED] src=2804:014d:5ca0:82f8:0000:0000:0000:0001
dst=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 sport=53 dport=49518 mark=0
zone=0 use=2
in nf_conntrack, the answer is coming out with the wrong ip, with prefix
2804. the interface has 2 ips. The 2804 is dynamic, added by dhcpv6 and
fd00 is static manually configured.
The query is from fd00 to fd00. shouldn't the answer come out with fd00 too?
What did I do wrong? How do I solve this? Can you help me?
Thanks,
Bruno.
next reply other threads:[~2022-09-23 22:07 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-23 22:07 Bruno Meirelles [this message]
2022-09-24 6:18 ` Rule does not work. This is configuration error or bug? Benno
2022-09-24 21:19 ` Bruno Meirelles
2022-10-05 22:25 ` Pablo Neira Ayuso
2022-10-09 18:14 ` Bruno Meirelles
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=88178cba-fbcf-70d0-bf11-380c4260d0cc@gmail.com \
--to=bmeirelles@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox