Re: Could someone tell me the rules of port translation in SNAT ?

Re: Could someone tell me the rules of port translation in SNAT ?

[ding dang]

>From: "spoft" <spoft@sohu.com>
>To: "ding dang" <jiadeip@hotmail.com>
>Subject: Re: Could someone tell me the rules of port translation in SNAT ?
>Date: Wed, 7 Jan 2004 16:19:53 +0800
>
>dst ip, dst port, and SNATed sport of the connections must be unique. So 
the firewall can NATed correctly and enough.
>So when:
>    1) dst ip and dst port are same,then the SNATed sport must be 
different between two connetions.
>    2) dst ip or dst port is different, then the SNATed sport may be same 
between two connections.

Thanks.

For 2) above:  when will the SNATed sport be different then?


> >
> > But what i observed is:(SNAT using UDP port 20000-30000)
> >
> > private addr         netfilter port         Internet addr
> > 10.0.0.8:2000 --->       20000       ---->   193.0.0.8:3000
> > 10.0.0.8:2001 --->       20000       ---->   193.0.0.8:3001
> > 10.0.0.8:2002 --->       20000       ---->   193.0.0.8:3002
> > that means DIFFERENT UDP requests from private network for DIFFERENT
> > Internet destination result in a same Netfilter port no matter the 
Internet
> > destination sends reply or not ;
> >
> > private addr         netfilter port         Internet addr
> > 10.0.0.8:2000 --->       20000       ---->   193.0.0.8:3000
> > 10.0.0.8:2001 --->       20001       ---->   193.0.0.8:3000
> > 10.0.0.8:2002 --->       20002       ---->   193.0.0.8:3000
> > DIFFERENT UDP requests from private network for a SAME Internet 
destination
> > result in DIFFERENT Netfilter ports, why?
> >
> > _________________________________________________________________
> > 与联机的朋友进行交流，请使用 MSN Messenger:  
http://messenger.msn.com/cn
> >
> >
> >

_________________________________________________________________
与联机的朋友进行交流，请使用 MSN Messenger:  http://messenger.msn.com/cn  

Re: Could someone tell me the rules of port translation in SNAT ?

[Antony Stone]

On Wednesday 07 January 2004 9:49 am, ding dang wrote:

> From: "spoft" <spoft@sohu.com>
>
> >To: "ding dang" <jiadeip@hotmail.com>
> >Subject: Re: Could someone tell me the rules of port translation in SNAT ?
> >Date: Wed, 7 Jan 2004 16:19:53 +0800
> >
> > dst ip, dst port, and SNATed sport of the connections must be unique. So
> > the firewall can NATed correctly and enough.
>
> > So when:
> >    1) dst ip and dst port are same,then the SNATed sport must be
> > different between two connetions.
>
> >    2) dst ip or dst port is different, then the SNATed sport may be same
> > between two connections.
>
> Thanks.
>
> For 2) above:  when will the SNATed sport be different then?

Just because something is possible does not mean you have to do it.

Netfilter allow you to change the source port in a SNAT rule; however if you 
can't think of a good reason why you'd want to, then don't.

Changing the source port (in either SNAT or DNAT) is not commonly needed, and 
it is difficult to think of a good example when you would want to, however 
this did not stop the authors of netfilter from including as something you 
could do if you really wanted to.

Netfilter's internal rules regarding source ports are quite simple (I posted 
these to the list the other day):

1. If a packet going through netfilter has a source port & IP combination 
which is unique (ie not already being used by another connection) then the 
source port will not be changed.

2. If the combination is not unique (so the socket cannot be bound uniquely 
for this connection) then a new source port is chosen at "random" in just the 
same way as it is for any newly-initiated connection on a Linux system.

Therefore unless you specify the port to be used, it will not be changed 
unless necessary, and if it is changed you cannot predict what it will 
become.

Regards,

Antony.

-- 
If you want to be happy for an hour, get drunk.
If you want to be happy for a year, get married.
If you want to be happy for a lifetime, get a garden.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Could someone tell me the rules of port translation in SNAT ?

[ding dang]

>>Therefore unless you specify the port to be used, it will not be changed
>unless necessary, and if it is changed you cannot predict what it will
>become.

I'm reading some source code for more details, bu i stopped at

      return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, 
dev,ip_finish_output2);

in    ip_output.c::ip_finish_output()

cause i don't know what part of code does POST_ROUTING work and SNAT 
implementation.

Need your help, thanks.

_________________________________________________________________
与联机的朋友进行交流，请使用 MSN Messenger:  http://messenger.msn.com/cn  

Re: Could someone tell me the rules of port translation in SNAT ?

[ding dang]

> > When using SNAT of Netfilter as an NAPT, how will Netfilter assign the
> > public UDP port for a UDP request from the private network to Internet?
>
>With both TCP and UDP, netfilter will use the source port contained in the
>original packet if it can (ie: if that source port is not being used for
>something else by the netfilter machine).   If this is not possible, then
>another port is chosen at random using the standard socket-binding 
mechanism
>used for any network connection.
>
> > Could someone detail it to me when the UDP request is
> > NEW/ESTABLISHED/RELATED/REPLIED/UNREPLIED?
>
>This makes no difference.

Thanks.

But what i observed is:(SNAT using UDP port 20000-30000)

private addr         netfilter port         Internet addr
10.0.0.8:2000 --->       20000       ---->   193.0.0.8:3000
10.0.0.8:2001 --->       20000       ---->   193.0.0.8:3001
10.0.0.8:2002 --->       20000       ---->   193.0.0.8:3002
that means DIFFERENT UDP requests from private network for DIFFERENT 
Internet destination result in a same Netfilter port no matter the Internet 
destination sends reply or not ;

private addr         netfilter port         Internet addr
10.0.0.8:2000 --->       20000       ---->   193.0.0.8:3000
10.0.0.8:2001 --->       20001       ---->   193.0.0.8:3000
10.0.0.8:2002 --->       20002       ---->   193.0.0.8:3000
DIFFERENT UDP requests from private network for a SAME Internet destination 
result in DIFFERENT Netfilter ports, why?

_________________________________________________________________
与联机的朋友进行交流，请使用 MSN Messenger:  http://messenger.msn.com/cn  

Could someone tell me the rules of port translation in SNAT ?

[ding dang]

When using SNAT of Netfilter as an NAPT, how will Netfilter assign the 
public UDP port for a UDP request from the private network to Internet? 
Could someone detail it to me when the UDP request is 
NEW/ESTABLISHED/RELATED/REPLIED/UNREPLIED?

Thanks.

_________________________________________________________________
与联机的朋友进行交流，请使用 MSN Messenger:  http://messenger.msn.com/cn  

Re: Could someone tell me the rules of port translation in SNAT ?

[Antony Stone]

On Monday 05 January 2004 6:22 am, ding dang wrote:

> When using SNAT of Netfilter as an NAPT, how will Netfilter assign the
> public UDP port for a UDP request from the private network to Internet?

With both TCP and UDP, netfilter will use the source port contained in the 
original packet if it can (ie: if that source port is not being used for 
something else by the netfilter machine).   If this is not possible, then 
another port is chosen at random using the standard socket-binding mechanism 
used for any network connection.

> Could someone detail it to me when the UDP request is
> NEW/ESTABLISHED/RELATED/REPLIED/UNREPLIED?

This makes no difference.

Antony.

-- 
In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.

In poetry, it is the exact opposite.

 - Paul Dirac

                                                     Please reply to the list;
                                                           please don't CC me.