lkml.org 
[lkml]   [1999]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: IP Masq weirdness
Date
Hello!

> I was looking at this yesterday: is there any way to get the
> correct address from the skb (this is in NF_IP_POST_ROUTING), using
> the dst field, or do I really need to use ip_route_output?

If this address was get via ip_route_input() it gives no useful
information for masquerading, certainly.


> I can do either, although using policy routing to control masquerading is not
> very clever in netfilter,

Right.

Though it could use the information received from ip_route_input() optionally
(copying the piece of code chacking RTCF_MASQ from 2.2 ip_forward()),
it does not contradict netfilter paradigm, faster a bit and, seems,
more convenient. At least, IP is aware of not sending redirects etc.
in this case. With firewall rules user has to filter out redirects
manually. Or did you solve the last problem for NAT/MASQ inside corresponding
modules?

> since you can just specify the NAT address
> directly,

I apologize, I am lazy to dig in netfilter now, but, please, tell me one thing:
does netfilter have facility to masquerade to fixed address or not yet? 8)8)

> but I don't really want to surprise people.

Good surprises are good. 8)

Alexey

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:54    [W:0.084 / U:0.912 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site