Re: NAT table bypass for local traffic

[Steve Fink <sphink@gmail.com>]

I probably shouldn't be responding, knowing as little as I do about
such things, but I believe this is by design. The nat table only gets
a crack at packets that initiate a connection -- as in, do not yet
exist in the connection tracking tables. This is true even of UDP
packets, because connection tracking heuristically assigns those to
connections based on observed IP,port pairs and the traffic pattern.

If you want to see those packets in the nat table, you have a number
of options: (1) figure out how to do what you want on a connection
basis and make sure you have everything set up before any connections
are established; (2) install conntrack-tools and do a conntrack -F to
flush out tracked connections, so you'll get one packet from each
connection through the nat table; or (3) add a rule to the raw table
that bypasses connection tracking via the NOTRACK target.

From the iptables manpage, in the description of the nat table: "This
table is consulted when a packet that creates a new connection is
encountered."

I don't know what mechanism makes related packets in an established
connection follow the translation actions set up by the initial
packets. There's a magic sheep bit in there somewhere.

On Wed, Apr 28, 2010 at 10:19 AM, Bill Prochazka <billprozac@gmail.com> wrote:
> So, I have an interesting observation.  I am doing some wonky fun
> stuff with iptables and have noticed that traffic generated by a host
> on an existing connection, is bypassing the NAT table for processing.
> I ran netcat listenening on a host and log all traffic on the OUTPUT
> and POSTROUTING chains.  When I connect from another host, the traffic
> is not processed by those chains.  However, if I initiate a connection
> from that host, the chains are processed appropriately.  Is this by
> design or is this a bug?  The traffic does pass through the mangle
> table, just not the NAT table.  Anyone ever encounter something like
> this?  I have verified this on both CentOS 5.4 (2.6.18) and busybox
> (2.6.27).
>
> Bill
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>