SYNPROXY *NAT/redirects etc.

[Christian Ruppert <idl0r@qasl.de>]

Hi,

I noticed that neither *NAT nor redirects will work when using the 
SYNPROXY module with e.g. those settings:
net.netfilter.nf_conntrack_tcp_loose=0
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.netfilter.nf_conntrack_tcp_loose=0
sysctl -w net.ipv4.tcp_timestamps=1

iptables -t raw -I PREROUTING -p tcp -m tcp --syn -j CT --notrack
iptables -I INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED 
-j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

So when doing a redirect for example, the SYNPROXY will open the 
connection to the original destination address and port but it will not 
go through the rest of the iptables rules and thus the redirect/NAT has 
no effect at all. DNAT might be somewhat different though, I wasn't able 
to figure out to where it tries to establish the connection.
If you disable the SYNPROXY it will work as expected.

I saw that a NF_ACCEPT will be used in the module and I assume that's 
why it does not further through the rules. I'm not sure if XT_CONTINUE 
(like in the handshake part) would be possible here or work at all. Or 
is there any other workaround to get this working? Or am I using it 
wrong? Is that by design?

-- 
Regards,
Christian Ruppert
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in