lkml.org 
[lkml]   [2009]   [Feb]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [BUG] SNAT sometimes allows packets to pass through unchanged
On Mon, 16 Feb 2009, Patrick McHardy wrote:

> The NAT table only sees the first packet of every connection
> and never INVALID packets. The mangle table should work fine.

I ended up adding a rule to the FORWARD chain of the filter table.
The trick was to select based on the state. That worked; it saw all
those un-NATed packets and was able to eliminate them. In case you're
curious, the rule was essentially this:

iptables -A FORWARD -o eth1 -s 10.0.0.0/8 -m state --state INVALID -j DROP

Ideally, the rule should select all the packets which haven't been
altered by SNAT, not just the ones marked INVALID. Is there any way to
do this?

Alan Stern



\
 
 \ /
  Last update: 2009-02-18 17:53    [W:0.150 / U:0.180 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site