Re: NAT table bypass for local traffic

[Bill Prochazka <billprozac@gmail.com>]

Steve,
Thanks for the info.  I have been playing around with it and that
helped...a little.  I played around with the raw table and found that
that fixed the issue of traversing the nat table for related
connections, but it does not fix the initial problem when acks are not
properly dealt with.  A more simple example is that ICMP echo requests
go out the nat table's output chain, but ICMP echo replies do not.

Bill

On Wed, Apr 28, 2010 at 3:46 PM, Jan Engelhardt <jengelh@medozas.de> wrote:
>
> On Wednesday 2010-04-28 19:59, Steve Fink wrote:
>>
> >From the iptables manpage, in the description of the nat table: "This
>>table is consulted when a packet that creates a new connection is
>>encountered."
>>
>>I don't know what mechanism makes related packets in an established
>>connection follow the translation actions set up by the initial
>>packets. There's a magic sheep bit in there somewhere.
>
> A ct entry with mappings already exists when a related packet shows up,
> so there is no need to do a relookup in the table.
>