<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Not all packets leaving the system get masqueraded"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1115">1115</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Not all packets leaving the system get masqueraded
</td>
</tr>
<tr>
<th>Product</th>
<td>iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>1.4.x
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>iptables
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>dennisml@conversis.de
</td>
</tr></table>
<p>
<div>
<pre>I'm seeing a strange phenomenon where some packets apparently bypass the
MASQUERADE rule identified by iptables.
The rule looks like this:
-A POSTROUTING -s 10.23.0.0/16 -o eth1 -j MASQUERADE
Doing a "tcpdump -nn -i eth1 src net 10.23.0.0/16" shows several packets per
second that leave the system with a source ip of 10.23.0.x. What these packets
all have in common is that they either have the RST or FIN flag set.
Since none of these connections show up in the conntrack table after I see
these packets I'm wondering if this is some kind of race condition where the
connection gets dropped from the table when this packet is encountered and when
it is sent out the interface the information required to translate the source
address is no longer available and the packet gets sent out as is.
I'm seeing all of this on a CentOS 7 system.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>