More on conntrack + NAT + mangle/nat tables
harmuth at mnemon.de
Wed Jul 6 12:09:22 CEST 2005
Lluís Batlle schrieb:
> I already understood that a packet enters chains in the 'nat' table
> only if it is the _first_ packet of a connection. In that case, we may
> do SNAT in the POSTROUTING chain of the 'nat' table.
> So, the packets arrive to the POSTROUTING chain of the 'mangle' table
> with the source IP address changed (if it's said by the rules of the
> 'nat' table).
No. According to the picture found at
packet flow is:
... --> [mangle:POSTROUTING] --> [nat:POSTROUTING]
So, all packets arrive in mangle:POSTROUTING with their source address
unchanged. DNAT - if configured - is already applied to the packet.
If I'm telling old stories now, forget it, but you can modify this
script to fit your needs:
Following the log (and /proc/net/ip_conntrack) you see the packet flow
in detail. And you see when [S|D]NAT ist applied.
> - I'm learning about the whole netfilter/policy router these days :)
> So I write a lot about that, which sounds strange to me. I hope I'm
> not annoying to the list.
I can only speak for myself - no, you aren't :)
Have a nice time,
More information about the netfilter