view nat mappings
stephen.clark at earthlink.net
Fri Feb 3 19:04:12 CET 2006
Pablo Neira Ayuso wrote:
>Stephen Clark wrote:
>>Does iptables have the capability to list out the actual nat
>>not just the rules that are currently active -
>>similar to the way FreeBSD's ipfilter/ipnat does?
>So, if I understood well, you want to get only current nat'ted
>If so, this is fairly easy to implement in the conntrack tool. Something
>like `conntrack -L nat` to show all current nat'ed connections. Is this
>really of interest for everyone?
Actually this is on an embedded system running uClinux 2.4.6, an
ActionTec DualPC Modem.
I am trying to use it as backup for ipsec traffic. Everything works
great until we have an interruption - like the phone connection drops
the vpn won't get reestablished. But when we
use an Apple Airport Extreme Base Station - the vpn get reestablished
with no problem. So it
seems ther is some state in the ActionTec modem/router - it is
performing masquerading - that keep the vpn from coming up. IT is really
strange because we get SA's (isakmp traffic) on both sides, but esp
traffic never gets across.
More information about the netfilter-devel