Messages in this thread | | | Date | Wed, 18 Feb 2009 11:49:58 -0500 (EST) | From | Alan Stern <> | Subject | Re: [BUG] SNAT sometimes allows packets to pass through unchanged |
| |
On Mon, 16 Feb 2009, Patrick McHardy wrote:
> The NAT table only sees the first packet of every connection > and never INVALID packets. The mangle table should work fine.
I ended up adding a rule to the FORWARD chain of the filter table. The trick was to select based on the state. That worked; it saw all those un-NATed packets and was able to eliminate them. In case you're curious, the rule was essentially this:
iptables -A FORWARD -o eth1 -s 10.0.0.0/8 -m state --state INVALID -j DROP
Ideally, the rule should select all the packets which haven't been altered by SNAT, not just the ones marked INVALID. Is there any way to do this?
Alan Stern
| |